PT-2026-5504 · WordPress · Supportcandy

Theklis Stefani · Published 2026-01-31 · Updated 2026-01-31 · CVE-2026-1251

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SupportCandy – Helpdesk & Customer Support Ticket System versions prior to 3.4.5

Description The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress has an Insecure Direct Object Reference issue in versions up to and including 3.4.4. This is due to a lack of validation on a user-controlled key within the add reply function. Authenticated attackers with subscriber-level access or higher can exploit this to steal file attachments uploaded by other users. This is achieved by specifying arbitrary attachment IDs in the description attachments parameter, allowing them to re-associate files with their own tickets and remove access from the original owners. The API endpoint involved is not explicitly mentioned. The vulnerable parameter is description attachments.

Recommendations Update SupportCandy – Helpdesk & Customer Support Ticket System to version 3.4.5 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1251

Affected Products

Supportcandy

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1251 · Security Note
• https://plugins.trac.wordpress.org/changeset/3448376 · Note
• https://plugins.trac.wordpress.org/browser/supportcandy/trunk/includes/admin/tickets/class-wpsc-individual-ticket.php#L1603 · Note
• https://t.me/cveNotify/150489 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/89df3005-0967-474f-8a4e-3b23273dd1a2?source=cve · Note
• https://t.me/CVEtracker/43376 · Telegram Post