CVE-2026-54826

HighCVSS 7.6

Published: 26/06/2026(UTC)Updated: 29/06/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The SupportCandy plugin version 3.4.6 and earlier contains an Insecure Direct Object References (IDOR) vulnerability for subscribers. This allows unauthorized access to other users' data.

Risk Assessment

The organization is at risk of leaking sensitive support ticket data, potentially violating customer privacy and compliance requirements.

Recommendation

Immediately update the SupportCandy plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in SupportCandy

See all

CVE-2026-73350High
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
CVE-2026-57711Medium
The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.

Original NVD description (English source)

Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.