SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ticket Attachment Disclosure via Attachment ID
- ID
- WPSEC-2026-0283
- Plugin
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent (supportcandy)
- Affected
- all versions before 3.5.4
- Remediation
- Update to 3.5.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent on WPSec AttackSurface
- Fix released
- Published
Description
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.5.3. The plugin does not check who owns an attachment ID before it binds that attachment to a new ticket or reply. On the new-ticket form, any attachment referenced by ID in an editor image URL in the description is re-bound to the new ticket with no check at all, including files that already belong to other customers' tickets. The other ticket, reply and file-field handlers accept any attachment that is not bound to an active ticket, such as pending uploads, customer-profile files and files from deleted replies. This makes it possible for authenticated attackers, with subscriber-level access and above, to move other users' attachments onto their own ticket and download them, which also removes the original owner's access. If ticket submission by guests is enabled, unauthenticated attackers can exploit this too.
References
- https://wpsec.com/vuln/WPSEC-2026-0283/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.4/
- https://wordpress.org/plugins/supportcandy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS