CVE-2026-81022 in SupportCandy Plugin
Summary
by MITRE • 09/09/2026
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in versions of the SupportCandy WordPress plugin prior to version 3.5.3 represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control and aligned with MITRE ATT&CK technique T1078 Valid Accounts or unauthorized data retrieval depending on implementation context. The core technical flaw lies in the application's logic for handling password-protected support tickets. When an end-user submits a request to view a specific ticket, they are required to provide a per-ticket authorization code intended to verify their identity and permission level. However, the plugin fails to perform adequate validation of this submitted code against the stored secure hash or value associated with that specific ticket before proceeding to render the content. This oversight allows an attacker who knows or can guess the identifier for a support ticket to bypass the authentication step entirely by submitting arbitrary or empty data in the authorization field.
From an operational perspective, this flaw results in the complete disclosure of sensitive information contained within customer support interactions. Since SupportCandy is often used to manage confidential communications between businesses and their clients, the ability to read any ticket without proper credentials poses a severe risk to privacy compliance frameworks such as GDPR or HIPAA if applicable data is present. Attackers can exploit this by iterating through common ticket identifiers or using automated tools to enumerate valid tickets on public-facing sites that utilize this plugin. The impact extends beyond simple information leakage; it undermines the trust model of the support system, potentially exposing intellectual property, personal identifiable information, and internal business discussions to unauthorized third parties without any need for prior authentication credentials.
The root cause is a lack of strict server-side validation where the application assumes the presence of an authorization code implies validity or fails to compare the input against the expected secure value before granting access. This type of vulnerability often stems from insecure direct object references combined with insufficient verification logic. To mitigate this issue, administrators must immediately update the SupportCandy plugin to version 3.5.3 or later where the validation logic has been corrected to ensure that the submitted code matches the stored authorization requirement for each specific ticket before any content is served. Additionally, implementing rate limiting on authentication endpoints and ensuring that error messages do not reveal whether a ticket exists can further reduce the attack surface by preventing enumeration attacks that might precede exploitation of this flaw.