CVE-2026-0683: SupportCandy WordPress Plugin SQLi Flaw

CVE-2026-0683 Overview

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This vulnerability stems from insufficient escaping on user-supplied operand values when using the equals operator, combined with a lack of sufficient preparation on existing SQL queries. Authenticated attackers with Subscriber-level access and above (including customers) can exploit this flaw to append additional SQL queries into already existing queries, enabling extraction of sensitive information from the database.

Critical Impact

Authenticated attackers with minimal privileges can extract sensitive data from the WordPress database, potentially compromising user credentials, customer information, and confidential support ticket contents.

Affected Products

• SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress versions up to and including 3.4.4
• WordPress installations using vulnerable SupportCandy plugin versions
• Websites with subscriber or customer user roles enabled

Discovery Timeline

• 2026-01-31 - CVE CVE-2026-0683 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-0683

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the SupportCandy plugin's Number-type custom field filter functionality. The vulnerability is network-accessible and requires only low-privilege authentication (Subscriber-level access), making it particularly dangerous for WordPress sites that allow customer registration. The attack does not require user interaction and can result in complete disclosure of confidential database contents.

The vulnerability exists in multiple code locations within the plugin, specifically in the ticket list handling and custom field type processing components. The affected code fails to properly sanitize and prepare SQL query parameters when processing filter operations with the equals operator on Number-type custom fields.

Root Cause

The root cause of this vulnerability is improper input validation and insufficient SQL query preparation. When users apply filters using the Number-type custom field with the equals operator, the plugin concatenates user-supplied values directly into SQL queries without proper escaping or parameterization. This violates secure coding practices for database interactions and creates a classic SQL Injection attack surface.

The vulnerable code paths are located in:

• class-wpsc-ticket-list.php at lines 1265 and 1288
• class-wpsc-cf-number.php at line 371

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the WordPress site with at least Subscriber-level privileges. The attacker can exploit this vulnerability by crafting malicious input through the custom field filter functionality in the ticket system interface.

The exploitation mechanism involves manipulating the operand value in Number-type custom field filter requests. By injecting SQL syntax when the equals operator is used, attackers can modify the underlying query logic to extract data from other database tables, including user credentials, email addresses, and sensitive support ticket information.

Since no verified proof-of-concept code is available, the exploitation technique involves injecting SQL metacharacters and additional query clauses through the filter parameter. Attackers would typically use UNION-based or blind SQL injection techniques to exfiltrate data from the WordPress database. For technical implementation details, refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Detection Methods for CVE-2026-0683

Indicators of Compromise

• Unusual database query patterns or errors in WordPress error logs related to SupportCandy plugin
• Anomalous filter requests to ticket list endpoints containing SQL metacharacters (quotes, semicolons, UNION keywords)
• Unexpected data access patterns from low-privilege user accounts
• Database query logs showing extended or modified queries originating from SupportCandy functions

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection attempt signatures targeting SupportCandy endpoints
• Implement database query logging and alert on queries containing UNION, SELECT, or other SQL keywords in unexpected contexts
• Review WordPress access logs for suspicious activity from subscriber or customer accounts accessing ticket filter functions
• Deploy intrusion detection rules to identify SQL injection payloads in HTTP POST/GET parameters

Monitoring Recommendations

• Enable detailed logging for the SupportCandy plugin and review for anomalous filter operations
• Configure database audit logging to capture all queries executed by the WordPress database user
• Implement real-time alerting for SQL syntax errors that may indicate injection attempts
• Monitor user activity for accounts making repeated requests to ticket filter endpoints

How to Mitigate CVE-2026-0683

Immediate Actions Required

• Update SupportCandy plugin to the latest patched version immediately
• If immediate update is not possible, temporarily disable Number-type custom field filters or restrict access to ticket filtering functionality
• Review database logs for evidence of prior exploitation attempts
• Audit subscriber and customer accounts for suspicious activity or unauthorized data access

Patch Information

A security patch addressing this SQL Injection vulnerability is available through the WordPress plugin repository. The fix is documented in WordPress Changeset 3448376. Site administrators should update to the latest version of SupportCandy that includes proper input sanitization and prepared statements for the affected custom field filter functionality.

Workarounds

• Implement a web application firewall (WAF) rule to block SQL injection attempts targeting SupportCandy endpoints
• Restrict subscriber and customer account creation if not essential for site operations
• Temporarily disable Number-type custom fields in SupportCandy configuration until patch is applied
• Use WordPress security plugins to add additional SQL injection protection layers

# Verify current SupportCandy plugin version
wp plugin list | grep supportcandy

# Update SupportCandy to latest version
wp plugin update supportcandy

# If update fails, deactivate plugin temporarily
wp plugin deactivate supportcandy