CVE-2026-94539
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to time-based SQL injection via the 'sort_by' parameter. Authenticated attackers with appropriate permissions can modify SQL queries and extract sensitive data from the database.
Risk Assessment
Risk of data leakage from the database, including user information and support tickets.
Recommendation
Update the SupportCandy plugin to the latest patched version. Conduct a user privilege audit and restrict access to administrative functions.
Other vulnerabilities in SupportCandy
See all- CVE-2026-94378Medium
The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to stored XSS via the 'name' parameter. Authenticated attackers with subscriber-level access can inject scripts that execute when a user visits the page.
- CVE-2026-81022Medium
The SupportCandy WordPress plugin before version 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
- CVE-2026-81021Medium
The SupportCandy WordPress plugin before version 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
- CVE-2026-73350High
Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.
- CVE-2026-57711Medium
The SupportCandy plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.4.8. The issue is due to improper input neutralization during web page generation.
- CVE-2026-54826High
The SupportCandy plugin version 3.4.6 and earlier contains an Insecure Direct Object References (IDOR) vulnerability for subscribers. This allows unauthorized access to other users' data.
Original NVD description (English source)
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the authenticated attacker to hold both a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS