漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
Vulnerability Description
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
CVSS Information
N/A
Vulnerability Type
授权机制缺失
Vulnerability Title
WordPress plugin 跨站请求伪造漏洞
Vulnerability Description
WordPress plugin是WordPress开源的一个应用插件。 Wordpress Plugin SupportCandy 中存在跨站请求伪造漏洞，该漏洞源于产品的wpsc_tickets请求未验证授权，未授权的攻击者可通过该漏洞删除任意票证。以下产品及版本受到影响：Wordpress Plugin SupportCandy 2.2.5 之前版本。
CVSS Information
N/A
Vulnerability Type
N/A