SupportCandy CVE-2026-94539

Exploitation requires the attacker to simultaneously hold (1) a WordPress account at Subscriber level or higher AND (2) a SupportCandy Agent account explicitly configured with the 'Assign Agents' permission - this is a non-default, administrator-granted permission combination, which is the primary limiting factor. The injectable surface is the 'sort_by' parameter on agent/ticket-list queries in all versions up to and including 3.5.3, where the value is insufficiently escaped and the SQL query is not properly prepared. No user interaction beyond the attacker's own authenticated request is needed (UI:N), and the attack is remote over the network (AV:N), but it cannot be performed by anonymous or ordinary-subscriber users lacking the agent permission, which meaningfully constrains the realistic attacker population to trusted-but-malicious or compromised agent accounts.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack but one that is NOT unauthenticated: PR:L confirms authentication is required. Crucially, the description reveals the privilege bar is higher than PR:L alone suggests - the attacker needs BOTH a Subscriber-level (or higher) WordPress account AND a SupportCandy Agent account carrying the non-default 'Assign Agents' permission. This dual, operator-granted prerequisite materially reduces real-world exploitability versus a plain authenticated flaw. Impact is confidentiality-only (C:H, I:N, A:N), consistent with a time-based blind SQL injection used for data extraction rather than modification or takeover. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description on attack vector (both network/web). The main caveat is that the dual-permission requirement is arguably under-weighted by the vendor's PR:L and S:U scoring - in practice this behaves closer to a privileged-insider or compromised-agent scenario. Net: patch on a normal cadence; it is not an emergency unless untrusted users are routinely granted SupportCandy agent permissions.

An attacker who already holds (or has phished/registered) a low-privilege WordPress account that has additionally been granted a SupportCandy Agent role with the 'Assign Agents' permission submits a crafted value in the 'sort_by' parameter of an agent/ticket-list request. Because the parameter is concatenated into an unprepared SQL query, the attacker uses time-based blind techniques to infer and exfiltrate database contents such as user records and credentials. No public exploit code was identified in the provided data, so exploitation currently requires manual crafting of the injection.