CVE-2021-24843

The CVE refers to the WordPress plugin SupportCandy (before 2.2.7) where the wpsc_tickets AJAX action lacks a CSRF check. This allows a logged-in attacker to trigger a request (via the set_delete_permanently_bulk_ticket setting_action) and delete arbitrary tickets. Root cause: missing CSRF protec...