Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: SupportCandy 3.5.3 Clear all filters
TI-2026-56035 CVE-2026-81022 · GHSA-9c6r-hmv4-wgpf

SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak

Priority LOW 30

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any supp…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-09 Fixed in 3.5.3 CWE-200
TI-2026-56034 CVE-2026-81021 · GHSA-c3ww-3c8m-36r9

SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

Priority LOW 30

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attach…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-09 Fixed in 3.5.3 CWE-200