5.3
Moyenne
CVE-2026-81021 The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket…
Description
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SupportCandy 3.2 | 3.2.9 → < 3.5.3 | 3.5.3 |
Autres CVE de SupportCandy
Les 5 CVE de SupportCandy →
CVE-2026-81022
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before…
5.3
Moyenne
CVE-2023-2805
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the…
Non notée
CVE-2023-2719
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent…
8.8
Élevée
CVE-2023-1730
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL…
9.8
Critique