Quick answers
- Is CVE-2026-81022 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81022 being exploited in the wild.
- How severe is CVE-2026-81022?
- Medium severity, with a CVSS score of 5.3, published 9 September 2026.
- Which products and versions are affected?
- SupportCandy SupportCandy 3.3.6 through 3.5.2.
- Is there a fix for CVE-2026-81022?
- A patch was published on 2026-09-07: Fixed in version 3.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81022 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-81022?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an insufficient input validation flaw in the ticket authorization mechanism. The plugin accepts per-ticket authorization codes but does not validate the submitted code before leaking the real code in HTTP redirect headers. An unauthenticated attacker can submit any value (including an empty string) for the auth_code parameter, triggering a 302 redirect response that discloses the legitimate authorization code in the Location header. Once obtained, the attacker can use the leaked code with the wpsc_load_older_threads AJAX endpoint to read the full ticket conversation. Since ticket IDs are sequential, an attacker can systematically enumerate and exfiltrate all support tickets on the site. The vulnerability affects versions 3.3.6 through 3.5.2 and is fixed in 3.5.3.
Affected products
- SupportCandy SupportCandy 3.3.6 through 3.5.2
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 3.5.3