Not rated
CVE-2021-24839 The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX…
Description
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SupportCandy – Helpdesk & Support Ticket System 2.2 | earliest → < 2.2.5 | 2.2.5 |
Other CVEs of SupportCandy – Helpdesk & Support Ticket System
The 5 CVEs of SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24880
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…
Not rated
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any…
Not rated
CVE-2021-24843
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could…
Not rated
CVE-2021-24878
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back…
Not rated