WordPress Plugin Vulnerabilities

SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

Description

The plugin does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

Proof of Concept

Affects Plugins

Plugin icon
supportcandy
Fixed in 3.5.3

References

CVE
CVE-2026-81021

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
c2e643fc-1d6d-429d-b2f6-d71a558bccaf

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2023-12-28
Title
Send Users Email < 1.4.4 - Sensitive Information Exposure via Error Logs
Published
2025-12-15
Title
Fancy Product Designer | WooCommerce WordPress < 6.5.0 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter
Published
2025-04-22
Title
WordPress Simple PayPal Shopping Cart < 5.1.3 - Unauthenticated Information Exposure via file_url Parameter
Published
2022-03-30
Title
Be POPIA Compliant < 1.1.6 - Unauthenticated Sensitive Information Exposure
Published
2026-08-03
Title
WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass