CVE-2026-81021 — SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

CVE-2026-81021

SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure PUBLISHED

Description (CNA)

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

Affected (CNA)

Vendor / product	Versions
Unknown / SupportCandy	affected 3.2.9 before 3.5.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c2e643fc-1d6d-429d-b2f6-d71a558bccaf/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.