CVE-2026-81021: SupportCandy WordPress Information Disclosure

CVE-2026-81021 Overview

CVE-2026-81021 is a broken access control vulnerability in the SupportCandy WordPress plugin versions before 3.5.3. The plugin fails to enforce authorization checks on one of its support-ticket attachment download paths. Unauthenticated attackers can read protected customer-uploaded attachments by enumerating sequential attachment identifiers. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Successful exploitation exposes personally identifiable information (PII), support correspondence, and any files customers uploaded through support tickets.

Critical Impact
Unauthenticated attackers can enumerate attachment IDs and download private customer files without any credentials or user interaction.

Affected Products

SupportCandy WordPress plugin versions before 3.5.3
WordPress sites using SupportCandy for customer support ticketing
Any deployment exposing the vulnerable attachment download endpoint to the internet

Discovery Timeline

2026-09-09 - CVE-2026-81021 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81021

Vulnerability Analysis

The SupportCandy plugin provides ticketing and file-attachment features for WordPress sites. Customers upload attachments to support tickets, and the plugin stores these files for retrieval by ticket participants. One of the attachment download paths omits the authorization check that verifies the requester belongs to the associated ticket. As a result, any HTTP client can request an attachment by supplying its numeric identifier. Because identifiers are assigned sequentially, an attacker can iterate through the ID space and download every stored attachment.

This is a classic Insecure Direct Object Reference (IDOR) pattern combined with missing authentication enforcement. Attachments may contain sensitive support content such as invoices, identity documents, screenshots of internal systems, or credentials shared during troubleshooting. See the WPScan Vulnerability Report for further technical detail.

Root Cause

The root cause is a missing authorization check on the vulnerable attachment download handler. The endpoint resolves the requested attachment identifier and streams file contents to the client without validating the session, ticket ownership, or an attachment-specific access token. Sequential integer identifiers make the exposure trivially enumerable.

Attack Vector

An unauthenticated remote attacker sends HTTP GET requests to the attachment download endpoint, incrementing the attachment ID parameter. Each valid ID returns the corresponding file. No credentials, tokens, or user interaction are required, and the attack can be automated with any HTTP scripting tool.

// No verified proof-of-concept code is available.
// The vulnerability is exploited by issuing sequential GET requests
// to the vulnerable attachment download endpoint with incrementing
// numeric identifiers. Refer to the WPScan advisory for details.

Detection Methods for CVE-2026-81021

Indicators of Compromise

Repeated HTTP GET requests to the SupportCandy attachment download endpoint with sequentially incrementing ID parameters from a single source IP.
High volume of successful 200 responses returning file content to unauthenticated sessions lacking valid ticket cookies.
Outbound file transfer patterns showing bulk retrieval of attachments within a short time window.

Detection Strategies

Review web server access logs for enumeration patterns against SupportCandy attachment URLs, focusing on requests without authenticated session cookies.
Deploy web application firewall (WAF) rules that flag rapid sequential access to attachment identifiers from the same client.
Correlate WordPress plugin version inventory with public advisory data to identify hosts running SupportCandy before 3.5.3.

Monitoring Recommendations

Alert on any single IP requesting more than a defined threshold of unique attachment IDs per minute.
Monitor for user-agent strings associated with scripted HTTP clients accessing ticketing endpoints.
Track bandwidth egress from the WordPress host to identify unusual bulk file transfers originating from the plugin.

How to Mitigate CVE-2026-81021

Immediate Actions Required

Upgrade the SupportCandy plugin to version 3.5.3 or later on all affected WordPress installations.
Audit web server logs for prior enumeration of attachment IDs and identify potentially exposed files.
Notify affected customers if support-ticket attachments were retrieved by unauthorized parties.

Patch Information

The vendor addressed the vulnerability in SupportCandy version 3.5.3 by adding the missing authorization check on the affected attachment download path. Administrators should apply the update through the WordPress plugin management interface or by installing the latest release from the official plugin repository. Details are documented in the WPScan Vulnerability Report.

Workarounds

If immediate patching is not possible, restrict access to the SupportCandy attachment endpoint at the web server or WAF layer to authenticated sessions only.
Temporarily disable the SupportCandy plugin on production sites until the update is applied.
Rotate any credentials or sensitive data that may have been shared through support-ticket attachments during the exposure window.

bash

# Example nginx rule to require an authenticated WordPress session cookie
# on the SupportCandy attachment download endpoint until patching is complete
location ~* /wp-content/plugins/supportcandy/.*attachment {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}