CVE-2026-25321: SupportCandy Auth Bypass Vulnerability

CVE-2026-25321 Overview

A Missing Authorization vulnerability has been identified in PSM Plugins SupportCandy, a popular WordPress help desk and customer support plugin. This vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized actions within the support ticket system. The flaw stems from insufficient authorization checks (CWE-862) that fail to properly validate user permissions before granting access to protected functionality.

Critical Impact

Unauthenticated attackers can bypass access controls to perform unauthorized actions within the SupportCandy plugin, potentially compromising support ticket data integrity and manipulating plugin configurations.

Affected Products

• SupportCandy WordPress Plugin versions through 3.4.4
• WordPress installations running vulnerable SupportCandy versions
• All sites using PSM Plugins SupportCandy with default configurations

Discovery Timeline

• 2026-02-19 - CVE-2026-25321 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25321

Vulnerability Analysis

This Missing Authorization vulnerability in SupportCandy represents a Broken Access Control flaw that can be exploited remotely without authentication. The vulnerability exists because certain plugin endpoints fail to properly verify whether the requesting user has appropriate permissions to perform the requested action. This allows unauthenticated or low-privileged users to access functionality that should be restricted to authorized personnel only.

The attack can be executed over the network without requiring any user interaction, making it particularly concerning for publicly accessible WordPress installations. While the vulnerability does not directly enable data theft or system disruption, it allows attackers to modify data or configurations in ways that were not intended by the system administrators.

Root Cause

The root cause of CVE-2026-25321 lies in CWE-862: Missing Authorization. The SupportCandy plugin fails to implement proper authorization checks on certain AJAX endpoints or administrative functions. When a request is made to these endpoints, the plugin processes the request without first verifying that the requesting user has the necessary capabilities or roles to perform that action. This architectural oversight allows any user—authenticated or not—to invoke protected functionality by directly accessing the vulnerable endpoints.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious HTTP requests directly to the vulnerable WordPress AJAX handlers or REST API endpoints exposed by the SupportCandy plugin. Since no authentication is required, the attacker simply needs to identify the vulnerable endpoint and submit appropriately formatted requests to exploit the missing authorization checks.

The attack path typically involves:

1. Identifying a WordPress site running a vulnerable version of SupportCandy
2. Discovering the exposed endpoints that lack proper authorization
3. Crafting requests to manipulate support ticket data or plugin settings
4. Submitting requests directly without valid authentication credentials

For detailed technical information about this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2026-25321

Indicators of Compromise

• Unusual AJAX requests to SupportCandy plugin endpoints from unauthenticated sessions
• Unexpected modifications to support tickets or plugin configuration settings
• Access logs showing repeated requests to /wp-admin/admin-ajax.php with SupportCandy-specific actions from external IP addresses
• Changes to ticket status, assignments, or metadata without corresponding authenticated user sessions

Detection Strategies

• Monitor WordPress AJAX requests targeting SupportCandy actions for anomalous patterns
• Implement Web Application Firewall (WAF) rules to detect unauthorized access attempts to plugin endpoints
• Review server access logs for suspicious POST requests to admin-ajax.php with SupportCandy action parameters
• Deploy SentinelOne Singularity platform for real-time detection of exploitation attempts and anomalous behavior

Monitoring Recommendations

• Enable verbose logging for WordPress AJAX handlers and SupportCandy plugin activity
• Configure alerting for bulk or automated requests to sensitive plugin endpoints
• Monitor for changes to support ticket data that cannot be attributed to authenticated administrative actions
• Implement file integrity monitoring for SupportCandy plugin files to detect unauthorized modifications

How to Mitigate CVE-2026-25321

Immediate Actions Required

• Update SupportCandy plugin to a version newer than 3.4.4 immediately
• Review all support ticket data for unauthorized modifications since plugin installation
• Audit WordPress user accounts and capabilities for any unauthorized changes
• Implement additional access controls at the web server or WAF level while patches are applied

Patch Information

Organizations should update the SupportCandy WordPress plugin to the latest patched version available. The vulnerability affects all versions through 3.4.4, so any version at or below this release is vulnerable. Administrators should check the official WordPress plugin repository or the Patchstack advisory for the recommended secure version.

Workarounds

• Temporarily disable the SupportCandy plugin until a patch can be applied
• Implement IP-based access restrictions to limit who can access WordPress AJAX endpoints
• Use a Web Application Firewall to block suspicious requests targeting SupportCandy actions
• Restrict access to /wp-admin/admin-ajax.php for unauthenticated users where feasible without breaking legitimate functionality

If immediate patching is not possible, consider adding server-level restrictions:

# Apache .htaccess restriction example for admin-ajax.php
# Note: This may impact legitimate AJAX functionality - test thoroughly
<Files admin-ajax.php>
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>