CVE-2026-81022 Overview
CVE-2026-81022 is an information disclosure vulnerability in the SupportCandy WordPress plugin versions prior to 3.5.3. The plugin fails to validate submitted per-ticket authorization codes before disclosing the real authorization code to the requester. Unauthenticated attackers can leverage this flaw to read the contents of any support ticket stored by the plugin. The weakness is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Unauthenticated attackers can retrieve confidential support ticket contents from affected SupportCandy installations without any prior access or user interaction.
Affected Products
- SupportCandy WordPress plugin versions prior to 3.5.3
- WordPress sites using SupportCandy for helpdesk or ticketing functionality
- Any deployment exposing SupportCandy ticket endpoints to unauthenticated network traffic
Discovery Timeline
- 2026-09-09 - CVE-2026-81022 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-81022
Vulnerability Analysis
SupportCandy issues each support ticket a per-ticket authorization code that acts as a shared secret between the plugin and the ticket owner. Requests to view a ticket must present this code to prove ownership. The vulnerable code path accepts a ticket identifier and an authorization code from the requester but does not compare the submitted code against the stored value before responding.
Instead, the plugin returns the real authorization code to the requester. An attacker can then reuse the disclosed code to fetch the full ticket contents through the standard viewing workflow. Because the flaw affects the authorization check itself, exploitation requires no credentials and no user interaction.
Root Cause
The root cause is a broken authorization check in the ticket lookup handler. The handler treats the presence of a request as sufficient to return the authorization code rather than validating the submitted code against the stored per-ticket secret. This design collapses authentication and authorization into a single unverified step, matching the pattern described in CWE-200.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request to the SupportCandy ticket endpoint containing an arbitrary or empty authorization code and a target ticket identifier. The plugin responds with the real authorization code for that ticket. The attacker then issues a follow-up request using the disclosed code to retrieve the ticket subject, body, attachments, and any personally identifiable information supplied by the ticket author.
No exploitation code is published for this issue. Technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-81022
Indicators of Compromise
- Repeated unauthenticated requests to SupportCandy ticket endpoints iterating through sequential ticket identifiers
- Access log entries showing the same client IP fetching many distinct ticket IDs in a short interval
- Outbound responses from /wp-admin/admin-ajax.php or SupportCandy REST routes containing authorization code fields to unauthenticated clients
Detection Strategies
- Inspect web server access logs for enumeration patterns targeting SupportCandy ticket parameters such as ticket_id and access_code
- Alert on responses to unauthenticated sessions that include ticket metadata or long random tokens consistent with per-ticket authorization codes
- Correlate spikes in ticket-view traffic with the absence of prior authenticated sessions from the same source
Monitoring Recommendations
- Enable verbose logging on the WordPress plugin and web application firewall for all SupportCandy endpoints
- Track the SupportCandy plugin version reported by WordPress and alert when it remains below 3.5.3
- Review helpdesk audit trails for ticket views that lack a corresponding authenticated user session
How to Mitigate CVE-2026-81022
Immediate Actions Required
- Upgrade the SupportCandy plugin to version 3.5.3 or later on every affected WordPress site
- Rotate authorization codes for tickets that may have been queried by untrusted sources after the plugin was installed
- Notify ticket submitters if disclosure of their ticket contents cannot be ruled out from log review
Patch Information
The vendor addressed CVE-2026-81022 in SupportCandy 3.5.3 by validating the submitted per-ticket authorization code before returning ticket data. Site administrators should update through the WordPress plugin manager or by deploying the fixed release from the plugin repository. Confirm the installed version after update by checking the SupportCandy entry on the WordPress plugins page.
Workarounds
- Restrict access to SupportCandy ticket endpoints behind an authenticated reverse proxy or IP allowlist until the patch is applied
- Deploy a web application firewall rule that blocks unauthenticated requests to SupportCandy ticket routes
- Temporarily disable the SupportCandy plugin if upgrade is not immediately feasible and ticket data is sensitive
# Verify installed SupportCandy version via WP-CLI
wp plugin get supportcandy --field=version
# Update to the patched release
wp plugin update supportcandy --version=3.5.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
