Supportcandy
Monthly
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
SupportCandy WordPress plugin before version 3.5.3 allows unauthenticated users to read the full contents of any support ticket by exploiting a missing pre-validation step on per-ticket authorization codes. The plugin discloses the genuine authorization code to any requester before verifying whether the submitted code is valid, effectively inverting the access control check and rendering the protection mechanism moot. A publicly available exploit exists via WPScan; no active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.14%.
Unauthenticated information disclosure in SupportCandy WordPress plugin before 3.5.3 exposes protected customer-uploaded support ticket attachments to any remote attacker. The attachment download endpoint lacks an authorization check and uses sequential numeric identifiers, enabling trivial enumeration of all attachments across all tickets regardless of ticket visibility or customer ownership. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation activity at time of analysis.
Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browser of any user - likely an administrator or support agent - who subsequently views the tainted content. The scope change (S:C in CVSS) reflects that injected script breaks out of the plugin's trust boundary and runs in the victim's full browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
SupportCandy WordPress plugin before version 3.5.3 allows unauthenticated users to read the full contents of any support ticket by exploiting a missing pre-validation step on per-ticket authorization codes. The plugin discloses the genuine authorization code to any requester before verifying whether the submitted code is valid, effectively inverting the access control check and rendering the protection mechanism moot. A publicly available exploit exists via WPScan; no active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.14%.
Unauthenticated information disclosure in SupportCandy WordPress plugin before 3.5.3 exposes protected customer-uploaded support ticket attachments to any remote attacker. The attachment download endpoint lacks an authorization check and uses sequential numeric identifiers, enabling trivial enumeration of all attachments across all tickets regardless of ticket visibility or customer ownership. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation activity at time of analysis.
Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browser of any user - likely an administrator or support agent - who subsequently views the tainted content. The scope change (S:C in CVSS) reflects that injected script breaks out of the plugin's trust boundary and runs in the victim's full browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog.
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.