CVE-2026-0683 — AI Deep Analysis Summary

🚨 **SQL Injection Vulnerability**: The SupportCandy plugin fails to properly escape user input when handling 'number type' custom field filters, allowing authenticated users to inject malicious SQL statements.…

🛠️ **Root Cause**: CWE-89 (SQL Injection). In `class-wpsc-cf-number.php`, numeric values for equality operators are not escaped, and SQL queries do not use prepared statements.…

🌐 **Scope**: All versions (including 3.4.4 and earlier). Component: SupportCandy – Helpdesk & Customer Support Ticket System plugin. Files involved: `class-wpsc-cf-number.php`, `class-wpsc-ticket-list.php`.

🔐 **Attacker Privileges**: Requires only authenticated user access (e.g., Subscriber/Customer).…

🔓 **Low Exploitation Barrier**: No admin privileges required—only a logged-in account (Subscriber level or higher).…

🔍 **No Public PoC**: No executable proof-of-concept code is provided in the reference links. ⚠️ No evidence of in-the-wild exploitation (no attack reports or samples found).

🔎 **Self-Check Method**: Verify if SupportCandy plugin is installed and version ≤ 3.4.4. 🔍 Scan files: `class-wpsc-cf-number.php` (L371) and `class-wpsc-ticket-list.php` (L1265, L1288) for unescaped SQL concatenation.

🛠️ **No Official Patch**: According to available data, no patch is released. However, upgrade to the latest version if a fixed release exists.…

🛡️ **Temporary Mitigation**: 1. Disable 'number type' custom field filters. 2. Restrict low-privilege users from accessing the ticketing system. 3. Enforce strict numeric input validation (e.g., allow only 0-9, -, .).…

⚠️ **High Priority**: CVSS 7.5 (H/C). Authenticated users can read sensitive data. While data destruction is not possible, the risk of information leakage is extremely high.…