What the vulnerability does
01Description
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'description_attachments' parameter, re-associating those files to their own tickets and removing access from the original owners.
Explanation of Vulnerability in Simple Terms
02Summary
SupportCandy versions up to 3.4.4 contain an authorization flaw that allows authenticated users to read and modify data they should not access. An attacker with a low-privilege account can view or alter sensitive information through the application. The vulnerability requires login credentials but no additional user interaction to exploit.
What an attacker can do
03Attacker Capabilities
Read and modify data belonging to other users or the system.
Potential impact on your site
04Site Impact
Ticket data, customer information, or support records may be exposed or altered by unauthorized users.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site.
Key dates
06Disclosure timeline
January 31, 2026
CVE published
April 8, 2026
Record updated
