CVE-2026-73350 Overview
CVE-2026-73350 is a broken authentication vulnerability affecting the SupportCandy WordPress plugin versions 3.5.1 and earlier. The flaw allows unauthenticated attackers to bypass authentication controls over the network without user interaction. The weakness maps to [CWE-266] Incorrect Privilege Assignment, indicating that the plugin grants privileges to actors who should not receive them. Successful exploitation results in high confidentiality impact and limited integrity impact on affected WordPress installations running the SupportCandy help-desk plugin.
Critical Impact
Remote unauthenticated attackers can bypass authentication in SupportCandy <= 3.5.1, exposing sensitive support ticket data and enabling limited modification of protected resources.
Affected Products
- SupportCandy WordPress plugin versions <= 3.5.1
- WordPress sites using SupportCandy for help-desk and ticketing
- Any deployment exposing SupportCandy endpoints to the internet
Discovery Timeline
- 2026-08-18 - CVE-2026-73350 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-73350
Vulnerability Analysis
The vulnerability resides in SupportCandy's authentication logic for versions 3.5.1 and earlier. Attackers reach the flawed code path over the network without credentials or user interaction. The [CWE-266] classification signals that the plugin assigns privileges to identities that should not hold them. In practice, this means an unauthenticated request can obtain access typically restricted to authenticated support agents or ticket owners.
The issue primarily exposes ticket data and related help-desk records, producing high confidentiality impact. Integrity impact is limited because the flaw grants only partial write capability rather than full administrative control. Availability is not affected. See the Patchstack WordPress Vulnerability Analysis for technical details.
Root Cause
The root cause is incorrect privilege assignment within SupportCandy's request handling. The plugin fails to properly validate that a requester holds the privileges required to access a given ticket, action, or protected endpoint. As a result, callers without valid authentication receive privileges reserved for authenticated users.
Attack Vector
Exploitation is remote and requires no privileges or user interaction. An attacker sends crafted HTTP requests to a vulnerable SupportCandy endpoint on a WordPress site. Because the plugin does not correctly enforce authentication, the request executes with elevated context. No verified public proof-of-concept is available at time of publication.
Detection Methods for CVE-2026-73350
Indicators of Compromise
- Unexpected access to SupportCandy ticket data from unauthenticated sessions or unknown IP addresses
- HTTP requests to SupportCandy AJAX or REST endpoints without valid WordPress authentication cookies
- Anomalous read or modification activity against wp_supportcandy_* database tables
- Spikes in requests to admin-ajax.php referencing SupportCandy actions from external sources
Detection Strategies
- Review WordPress and web server logs for SupportCandy endpoint access lacking valid session cookies or nonces
- Correlate plugin version data across managed WordPress sites and flag any instance running 3.5.1 or earlier
- Deploy web application firewall rules that identify SupportCandy request patterns from unauthenticated clients
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward events to a central SIEM for correlation
- Alert on read access to support ticket tables outside expected administrator or agent accounts
- Monitor outbound data volumes from WordPress hosts for signs of bulk ticket data exfiltration
How to Mitigate CVE-2026-73350
Immediate Actions Required
- Identify all WordPress instances running SupportCandy version 3.5.1 or earlier across the environment
- Update SupportCandy to the fixed version referenced in the Patchstack advisory as soon as it is available
- Restrict network exposure of SupportCandy endpoints to trusted networks where feasible
- Rotate credentials and API keys for accounts that may have been exposed via ticket data
Patch Information
Refer to the vendor and Patchstack advisory for the patched SupportCandy release addressing CVE-2026-73350. Apply the update through the WordPress plugin management interface or via wp-cli using wp plugin update supportcandy. Validate the installed version after patching to confirm remediation.
Workarounds
- Deactivate the SupportCandy plugin until a patched version is installed if immediate update is not possible
- Use a WordPress-aware web application firewall to block unauthenticated requests to SupportCandy endpoints
- Place the WordPress admin and plugin endpoints behind IP allow-listing or VPN access
# Update SupportCandy via wp-cli and verify installed version
wp plugin update supportcandy
wp plugin get supportcandy --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
