CVE-2026-81022
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The SupportCandy WordPress plugin before version 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
Risk Assessment
An attacker can access sensitive information contained in support tickets, such as customer personal data, potentially leading to privacy breaches and loss of trust.
Recommendation
Update the SupportCandy plugin to version 3.5.3 or later, which includes fixes for authorization code validation.
Other vulnerabilities in SupportCandy
See all- CVE-2026-81021Medium
The SupportCandy WordPress plugin before version 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- CVE-2026-73350High
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
- CVE-2026-57711Medium
The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.
- CVE-2026-54826High
The SupportCandy plugin version 3.4.6 and earlier contains an Insecure Direct Object References (IDOR) vulnerability for subscribers. This allows unauthorized access to other users' data.
Original NVD description (English source)
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS