EUVD-2026-74707
GHSA-c3ww-3c8m-36r9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth or interaction required; only partial confidentiality impact (attachments only), no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
AnalysisAI
Unauthenticated information disclosure in SupportCandy WordPress plugin before 3.5.3 exposes protected customer-uploaded support ticket attachments to any remote attacker. The attachment download endpoint lacks an authorization check and uses sequential numeric identifiers, enabling trivial enumeration of all attachments across all tickets regardless of ticket visibility or customer ownership. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions required for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly captures the network-reachable, zero-prerequisite nature of the flaw with limited confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update SupportCandy to version 3.5.3 or later, which adds the missing authorization check on the attachment download endpoint - this is the only confirmed fix per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Supportcandy
View allThe SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL stateme
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_a
SupportCandy WordPress plugin before version 3.5.3 allows unauthenticated users to read the full contents of any support
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote
Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authen
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today