Executive brief
SupportCandy is a WordPress plugin used to manage customer support tickets and helpdesk operations. A security flaw allows logged-in users with basic 'Subscriber' permissions to bypass authorization checks and potentially access sensitive support tickets or data belonging to other users. This could lead to the exposure of private customer communications and internal support information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the SupportCandy plugin for WordPress (versions <= 3.4.6) due to insufficient authorization checks on user-controlled keys. An attacker authenticated with low-level 'Subscriber' privileges can exploit this by manipulating identifiers in requests to access or interact with data objects (such as support tickets) they are not authorized to view. This is classified as a Broken Access Control issue (CWE-639). The vulnerability is addressed in version 3.4.7.
Affected products
- PSM Plugins SupportCandy <= 3.4.6
Timeline
- 2026-04-29: other: Vulnerability reported by researcher HieuPenguinnn
- 2026-06-17: advisory: Patchstack published advisory
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Version 3.4.7 released to address the issue