What is the CVSS score of EUVD-2026-39673?

EUVD-2026-39673 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of SupportCandy are affected by EUVD-2026-39673?

SupportCandy, a widely-deployed WordPress helpdesk plugin affecting versions 3.4.6 and earlier, contains an authorization flaw that allows any registered user to view support tickets and sensitive…

How to fix or mitigate EUVD-2026-39673?

24 hours: Inventory WordPress installations running SupportCandy ≤3.4.6; audit support ticket access logs for suspicious low-privilege account activity. 7 days: Disable open user registration or restrict Subscriber permissions to SupportCandy; implement WAF rules to block direct object reference patterns; enable access monitoring. 30 days: Monitor Patchstack and vendor channels for patch availability; establish timeline to upgrade once patch is released.

SupportCandy EUVD-2026-39673

| CVE-2026-54826 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-6mpj-cp6h-6c54

WordPress Authentication Bypass Wordpress Plugin

7.6

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Network-reachable IDOR needs only a Subscriber account (PR:L) and no interaction; primary impact is reading others' ticket data (C:H) with limited write/availability effect (I:L/A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:33 vuln.today

DescriptionCVE.org

Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

AnalysisAI

Insecure Direct Object Reference in the SupportCandy WordPress helpdesk plugin (versions 3.4.6 and earlier) lets an authenticated low-privilege user (Subscriber) access support tickets and data belonging to other users by manipulating object identifiers, effectively bypassing authorization controls. The flaw carries a CVSS 3.1 base score of 7.6 (PR:L) and was reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis. Because SupportCandy frequently runs on sites with open user registration, the Subscriber prerequisite is often trivially met.

Technical ContextAI

SupportCandy is a popular self-hosted WordPress helpdesk/ticketing plugin that stores customer support tickets, messages, and attachments tied to per-user object IDs. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin trusts a client-supplied identifier (e.g., a ticket or record ID) to fetch a resource without verifying that the requesting account actually owns or is permitted to view it. Because the access-control decision is missing or relies solely on the object reference, any authenticated Subscriber can enumerate or directly request other users' ticket objects. The Patchstack 'Authentication Bypass' tag here refers to this horizontal authorization bypass rather than a full login bypass.

RemediationAI

No vendor-released patch version was identified in the provided data; the advisory denotes affected versions as 3.4.6 and below, so administrators should upgrade SupportCandy to the latest available release above 3.4.6 from the WordPress plugin repository and confirm the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-6-insecure-direct-object-references-idor-vulnerability?_s_id=cve) before relying on it. As compensating controls until patched, disable open/self-service user registration (WordPress Settings > General > 'Anyone can register') to remove the easy path to a Subscriber account - trade-off: this blocks legitimate self-signup support workflows; audit and prune untrusted Subscriber accounts; and consider deploying a virtual patch via Patchstack or a WAF rule that constrains access to SupportCandy ticket endpoints. Restricting helpdesk access behind authentication proxies or IP allowlists is an option for internal deployments but will break public-facing support portals.