CVE-2026-94539 Overview
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress contains a time-based SQL injection vulnerability in the sort_by parameter. The flaw affects all versions through 3.5.3. Insufficient escaping of the user-supplied parameter and inadequate preparation of the existing SQL query allow authenticated attackers to append arbitrary SQL to database operations. Exploitation requires a Subscriber-level (or higher) WordPress role combined with a SupportCandy Agent account holding the Assign Agents permission. Successful attacks can extract sensitive data from the WordPress database. The weakness is tracked under [CWE-89].
Critical Impact
Authenticated attackers with custom-level access can extract sensitive database contents through time-based SQL injection in the SupportCandy plugin.
Affected Products
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent for WordPress
- All plugin versions up to and including 3.5.3
- WordPress sites configured with SupportCandy Agent accounts holding Assign Agents permission
Discovery Timeline
- 2026-10-03 - CVE-2026-94539 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-94539
Vulnerability Analysis
The vulnerability resides in the SupportCandy ticket listing functionality. The plugin accepts a sort_by parameter from authenticated users and concatenates it into an SQL query without sufficient escaping or use of prepared statements. Attackers can inject additional SQL fragments that execute within the WordPress database context.
Because the injection is time-based, attackers infer data by observing server response delays rather than reading query output directly. This method remains effective for exfiltrating credentials, API tokens, personally identifiable information, and other data stored in wp_users, wp_usermeta, and SupportCandy ticket tables.
Exploitation does require authentication plus a SupportCandy Agent role with the Assign Agents permission, which limits the attacker population but does not prevent abuse by malicious insiders or compromised low-privilege accounts.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected code paths in class-wpsc-ticket-list.php, class-wpsc-functions.php, and class-wpsc-agent.php concatenate the sort_by value directly into dynamic SQL instead of binding it through $wpdb->prepare() with a strict allowlist of column names and sort directions.
Attack Vector
An attacker authenticates to the target WordPress site using a Subscriber-or-higher account that also holds a SupportCandy Agent record with the Assign Agents permission. The attacker sends a crafted request to the SupportCandy ticket listing endpoint, supplying a malicious sort_by value that embeds conditional time-delay SQL. By varying the payload and measuring response times, the attacker extracts data one bit at a time from the database.
The vulnerability is exploitable over the network and does not require user interaction. Technical references include the vulnerable source lines in the WordPress Code Browser - Ticket List and the WordPress Code Browser - Agent Class.
Detection Methods for CVE-2026-94539
Indicators of Compromise
- Web server access logs containing SupportCandy ticket listing requests with sort_by values that include SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or inline comment sequences
- Abnormally long HTTP response times from SupportCandy endpoints that correlate with specific authenticated sessions
- Unexpected SupportCandy Agent accounts holding the Assign Agents permission that were created or elevated without administrative approval
Detection Strategies
- Deploy web application firewall rules that inspect the sort_by parameter for SQL metacharacters and known time-based payloads
- Enable WordPress query logging or MySQL slow query logs to surface sessions issuing SLEEP() or similarly delayed queries from the plugin
- Correlate authenticated SupportCandy requests with database query duration to identify blind extraction attempts
Monitoring Recommendations
- Alert on repeated SupportCandy requests from the same authenticated user that generate response times above a baseline threshold
- Monitor creation or privilege changes affecting SupportCandy Agent records, especially grants of the Assign Agents permission
- Review the Wordfence Vulnerability Report for updated signatures and threat intelligence
How to Mitigate CVE-2026-94539
Immediate Actions Required
- Update the SupportCandy plugin to a version later than 3.5.3 as soon as the vendor patch is available
- Audit all SupportCandy Agent accounts and revoke the Assign Agents permission from users who do not require it
- Rotate credentials, API keys, and secrets stored in the WordPress database if exploitation is suspected
Patch Information
The vendor addressed the issue in WordPress Code Changeset 3718257. Administrators should install the fixed release from the WordPress Plugin Repository and verify that production sites no longer run version 3.5.3 or earlier.
Workarounds
- Temporarily restrict the Assign Agents permission to a minimal set of trusted administrators until the plugin is patched
- Place a web application firewall rule in front of SupportCandy endpoints to block requests with suspicious sort_by values
- Disable the SupportCandy plugin on sites that cannot immediately apply the update and do not require ticketing functionality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
