CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to download attachments for support tickets that don't belong to them. If an admin enables tickets for guests, this can be exploited by unauthenticated attackers.
Explanation of Vulnerability in Simple Terms
SupportCandy versions up to 3.3.0 contain an improper access control vulnerability that allows authenticated users to read sensitive information they should not have access to. An attacker with a low-privilege account can view confidential data by exploiting insufficient permission checks. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Read sensitive information accessible to other users or higher-privilege accounts.
Potential impact on your site
Customer support data, tickets, or user information may be exposed to unauthorized staff or low-privilege accounts.
Conditions required to exploit
Valid login account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
