Unrated severityNVD Advisory· Published Sep 9, 2026

CVE-2026-81022

Description

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.

Affected products

WordPress/Supportcandyllm-fuzzy
Range: <3.5.3
Package: https://wordpress.org/plugins/supportcandy

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/30866042-7003-434d-9d86-c6527f97374b/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000