CVE-2021-24843

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsctickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction...

PT-2022-9481

Name of the Vulnerable Software and Affected Versions SupportCandy WordPress plugin versions prior to 2.2.7 Description The issue is related to the lack of a CRSF check in the wpsc tickets AJAX action of the SupportCandy WordPress plugin. This could allow attackers to make a logged-in admin call...