CVE-2026-1251: SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'addreply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'descriptionattachments' parameter, re-associating those files to their own tickets and removing access from the original owners.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1251?
CVE-2026-1251 is classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive ticket data.
How do I fix CVE-2026-1251?
To mitigate CVE-2026-1251, upgrade the SupportCandy plugin to version 3.4.5 or later where the vulnerability has been addressed.
What versions are affected by CVE-2026-1251?
CVE-2026-1251 affects all versions of the SupportCandy plugin for WordPress up to and including version 3.4.4.
What is an Insecure Direct Object Reference in the context of CVE-2026-1251?
Insecure Direct Object Reference in CVE-2026-1251 allows authenticated users to access, modify, or delete tickets they shouldn’t have permission to handle.
Who is vulnerable to CVE-2026-1251?
Users of the SupportCandy plugin for WordPress with versions 3.4.4 and below are vulnerable to CVE-2026-1251.