CVE-2026-81022

The SupportCandy WordPress plugin (versions 3.3.6 through 3.5.2 ) fails to validate a submitted per-ticket authorization code before disclosing the real code to the requester. This allows unauthenticated attackers over the network to read the contents of any support ticket by exploiting the autho...

CVE-2026-81022 SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...