medium5.3
CVE-2026-81022
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, al…
Impact
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
Affected products
| Product | Affected versions |
|---|---|
| SupportCandy WordPress Plugin | before 3.5.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.