EUVD-2026-60777
GHSA-fm54-qhj9-vvcr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-accessible broken authentication with no credentials or interaction required (PR:N, UI:N) yields high confidentiality and low integrity impact consistent with the information disclosure classification.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
AnalysisAI
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector explicitly assigns PR:N and UI:N, confirming fully unauthenticated exploitation with no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N reflects a network-exploitable flaw with no authentication barrier, no user interaction, and no special configuration required - the highest-risk profile short of scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker passively identifies a WordPress site running SupportCandy via plugin enumeration (e.g., scanning for the plugin's readme.txt or known asset paths), then sends a crafted HTTP POST request to the vulnerable AJAX or REST endpoint without providing any authentication token or session cookie. The broken authentication check passes the request through as a privileged operation, allowing the attacker to enumerate or extract support ticket contents including customer contact details and issue descriptions. … |
| Remediation | The primary remediation is to update the SupportCandy plugin to the version released after 3.5.1 immediately via the WordPress dashboard or wp-cli; the exact patched version should be confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-5-1-broken-authentication-vulnerability or the official PSM Plugins changelog, as a specific fix version number was not stated in the available source data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running SupportCandy versions 3.5.1 or earlier; disable the plugin or implement immediate network-level access restrictions to prevent unauthenticated access to support ticket endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Supportcandy
View allThe SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL stateme
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_a
Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authen
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today