CVE-2021-24843

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsctickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction...

CVE-2021-24839

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsctickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction. Other actions may be affected as well...

PT-2022-9480 · WordPress · Supportcandy

Name of the Vulnerable Software and Affected Versions: SupportCandy WordPress plugin versions prior to 2.2.5 Description: The issue is related to the lack of authorisation and CSRF checks in the wpsc tickets AJAX action, which could allow unauthenticated users to delete arbitrary tickets via the...

PT-2022-9481

Name of the Vulnerable Software and Affected Versions SupportCandy WordPress plugin versions prior to 2.2.7 Description The issue is related to the lack of a CRSF check in the wpsc tickets AJAX action of the SupportCandy WordPress plugin. This could allow attackers to make a logged-in admin call...

PT-2022-9490

Name of the Vulnerable Software and Affected Versions SupportCandy WordPress plugin versions prior to 2.2.7 Description The issue concerns a lack of CSRF check in the wpsc tickets AJAX action and insufficient sanitisation or escaping in some filter fields. This could allow attackers to make a...