Executive brief
SupportCandy is a WordPress plugin used to manage customer support tickets. The plugin fails to validate authorization codes when displaying ticket information, allowing anyone on the internet to read the contents of any support ticket without authentication. This could expose sensitive customer information, private conversations, and potentially enable social engineering or data theft.
Technical details
The vulnerability is an insufficient input validation flaw in the ticket authorization mechanism. The plugin accepts per-ticket authorization codes but does not validate the submitted code before leaking the real code in HTTP redirect headers. An unauthenticated attacker can submit any value (including an empty string) for the auth_code parameter, triggering a 302 redirect response that discloses the legitimate authorization code in the Location header. Once obtained, the attacker can use the leaked code with the wpsc_load_older_threads AJAX endpoint to read the full ticket conversation. Since ticket IDs are sequential, an attacker can systematically enumerate and exfiltrate all support tickets on the site. The vulnerability affects versions 3.3.6 through 3.5.2 and is fixed in 3.5.3.
Affected products
- SupportCandy SupportCandy 3.3.6 through 3.5.2
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 3.5.3