PT-2026-5504 · WordPress · Supportcandy

Theklis Stefani · Publicado 2026-01-31 · Atualizado 2026-01-31 · CVE-2026-1251

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SupportCandy – Helpdesk & Customer Support Ticket System versions prior to 3.4.5

Description The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress has an Insecure Direct Object Reference issue in versions up to and including 3.4.4. This is due to a lack of validation on a user-controlled key within the add reply function. Authenticated attackers with subscriber-level access or higher can exploit this to steal file attachments uploaded by other users. This is achieved by specifying arbitrary attachment IDs in the description attachments parameter, allowing them to re-associate files with their own tickets and remove access from the original owners. The API endpoint involved is not explicitly mentioned. The vulnerable parameter is description attachments.

Recommendations Update SupportCandy – Helpdesk & Customer Support Ticket System to version 3.4.5 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1251

Produtos afetados

Supportcandy

Referências · 6

• https://plugins.trac.wordpress.org/changeset/3448376 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1251 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/supportcandy/trunk/includes/admin/tickets/class-wpsc-individual-ticket.php#L1603 · Nota
• https://t.me/cveNotify/150489 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/89df3005-0967-474f-8a4e-3b23273dd1a2?source=cve · Nota
• https://t.me/CVEtracker/43376 · Publicação no Telegram