Executive brief
SupportCandy is a WordPress plugin that manages customer support tickets and attachments. The plugin fails to check whether a user has permission to download ticket attachments, allowing unauthenticated visitors to access confidential customer files (like uploaded images and documents) by guessing sequential attachment identifiers. This exposes sensitive customer data without requiring any login or authentication.
Technical details
The vulnerability is an authorization bypass in the attachment download functionality. The plugin does not perform an authorization check on one of its support-ticket attachment download paths (the wpsc_attachment parameter), allowing unauthenticated attackers to enumerate and download protected attachments via sequential identifier manipulation. The vulnerability specifically affects in-progress editor images created when customers insert images into the ticket rich-text editor; these are returned with no authorization token. Attackers can request attachments directly (e.g., ?wpsc_attachment=1..N) without authentication and receive the raw file bytes. Other attachment types (submitted replies) do include authorization checks, and direct file access via wp-content/uploads/wpsc/ is blocked, confirming this is a missing check rather than intentional behavior. The vulnerability was fixed in version 3.5.3.
Affected products
- Wordpress.org SupportCandy 3.2.9 to 3.5.2
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 3.5.3