CVE-2026-81021: SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

Q: Which deployments are affected?

SupportCandy WordPress plugin versions 3.2.9 through 3.5.2 are affected. Version 3.5.3 is identified as the first version not affected by this issue.

Q: What does an attacker need to exploit this issue?

No authentication is required. An attacker can enumerate sequential attachment identifiers to access protected customer-uploaded ticket attachments through the affected download path.

Q: What information may be exposed?

Protected attachments uploaded by customers to support tickets may be readable by unauthenticated attackers. The specific contents depend on the files attached to tickets in the affected deployment.

Published Sep 9, 2026

Updated

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

Affected Software

1 affected component

SupportCandy WordPress plugin>3.2.9<=3.5.2

Event History

Sep 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

SupportCandy WordPress plugin versions 3.2.9 through 3.5.2 are affected. Version 3.5.3 is identified as the first version not affected by this issue.

What does an attacker need to exploit this issue?

No authentication is required. An attacker can enumerate sequential attachment identifiers to access protected customer-uploaded ticket attachments through the affected download path.

What information may be exposed?

Protected attachments uploaded by customers to support tickets may be readable by unauthenticated attackers. The specific contents depend on the files attached to tickets in the affected deployment.