CVE-2026-54826 Overview
CVE-2026-54826 is an Insecure Direct Object Reference (IDOR) vulnerability in the SupportCandy WordPress plugin affecting versions up to and including 3.4.6. The flaw allows authenticated users with subscriber-level access to reference and manipulate objects belonging to other users by supplying arbitrary identifiers. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key. Attack complexity is low and no user interaction is required, but authentication is needed to reach the vulnerable code paths. See the Patchstack Vulnerability Report for advisory details.
Critical Impact
Authenticated subscribers can access or modify support ticket data belonging to other users, exposing confidential correspondence and undermining tenant isolation.
Affected Products
- SupportCandy WordPress plugin versions <= 3.4.6
- WordPress installations that expose the plugin's ticket endpoints to subscriber accounts
- Multi-tenant WordPress deployments relying on SupportCandy for customer support workflows
Discovery Timeline
- 2026-06-26 - CVE-2026-54826 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-54826
Vulnerability Analysis
The SupportCandy plugin exposes ticket and object identifiers through request parameters processed by its request handlers. When a subscriber submits a request that includes an identifier such as a ticket ID, the plugin fails to verify that the requesting user owns or has explicit permission to access the referenced object. The authorization check is limited to confirming that the caller is authenticated, without binding the requested resource to the caller's identity. This allows a subscriber to iterate identifiers and reach records that should be restricted.
The impact profile shows high confidentiality impact with lower integrity and availability effects, consistent with IDOR flaws that primarily expose data belonging to other users. Because the attack vector is network-based and complexity is low, mass enumeration of ticket identifiers is straightforward once a valid subscriber session exists.
Root Cause
The root cause is missing object-level authorization. The plugin trusts the object identifier supplied in the request without cross-referencing it against the authenticated user's ownership or role. This is a classic [CWE-639] pattern where the access control decision relies on knowledge of a predictable key rather than a server-side ownership check.
Attack Vector
An attacker registers or compromises any subscriber-level account on the target WordPress site. The attacker then issues requests to SupportCandy endpoints that accept a ticket or resource identifier, substituting identifiers belonging to other users. The vulnerable handler returns or modifies the referenced object without verifying ownership, disclosing ticket contents, attachments, or metadata.
No verified public exploit code is available. Refer to the Patchstack Vulnerability Report for advisory context.
Detection Methods for CVE-2026-54826
Indicators of Compromise
- Subscriber accounts issuing high volumes of requests to SupportCandy AJAX endpoints with sequential or varied ticket identifiers
- Web server logs showing successful 200 responses to ticket-view or ticket-edit actions initiated by low-privilege accounts
- Access to ticket records by users who are not the ticket creator or assigned agent
- Newly registered subscriber accounts followed by rapid enumeration of id or ticket_id parameter values
Detection Strategies
- Correlate WordPress user roles with SupportCandy request logs to flag subscribers accessing tickets they do not own
- Alert on brute-force patterns against integer identifiers in plugin request parameters
- Review database audit trails for reads or writes to SupportCandy ticket tables by unexpected user IDs
Monitoring Recommendations
- Enable verbose logging on the WordPress admin-ajax.php and REST endpoints exposed by SupportCandy
- Monitor for anomalous spikes in ticket-object access outside normal support workflow hours
- Track subscriber account creation rates and follow-on plugin interactions to detect automated abuse
How to Mitigate CVE-2026-54826
Immediate Actions Required
- Upgrade the SupportCandy plugin to a version later than 3.4.6 that contains the vendor's authorization fix
- Audit existing subscriber accounts and disable those that are inactive or unrecognized
- Review SupportCandy ticket access logs for evidence of cross-user access prior to patching
Patch Information
Update SupportCandy to the fixed release identified in the Patchstack Vulnerability Report. Apply the patch across all WordPress environments, including staging and disaster-recovery sites, and validate that the plugin version reported in the WordPress admin dashboard matches the fixed release.
Workarounds
- Restrict WordPress registration or require administrator approval for new subscriber accounts until the patch is applied
- Place the WordPress site behind a Web Application Firewall (WAF) rule that inspects SupportCandy request parameters for identifier tampering
- Temporarily disable the SupportCandy plugin on sites where a fixed version cannot be installed immediately
# Configuration example: update SupportCandy via WP-CLI
wp plugin update supportcandy
wp plugin get supportcandy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
