CVE-2026-81021— SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
Quick assessment
Affected
Unknown SupportCandy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SupportCandy WordPress 插件在 3.5.3 之前的版本中，其支持工单附件下载路径之一未执行身份验证检查，使得未经验证的攻击者能够通过枚举连续的附件标识符来读取受保护的客户上传附件。
Possible ATT&CK Techniques 1 AI
T1137 · Office Application StartupAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | SupportCandy | 3.2.9< 3.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81021
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | SupportCandy | 3.2.9 ~ 3.5.3 | - |
|
II. Public POCs for CVE-2026-81021
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81021
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81021 (1)
-
🔗 SupportCandy 3.2.9 – 3.5.2 – Unauthenticated Ticket Attachment Disclosure | CVE 2026-81021 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-09 · 28 CVEs total
| CVE-2026-19855 | 6.5 MEDIUM | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Short |
| CVE-2026-85117 | 6.5 MEDIUM | Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via F |
| CVE-2026-83537 | 5.3 MEDIUM | WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymen |
| CVE-2026-80440 | 4.8 MEDIUM | Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Plac |
| CVE-2025-15690 | Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles | |
| CVE-2026-13144 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset | |
| CVE-2026-13146 | WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR | |
| CVE-2026-14962 | ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id | |
| CVE-2026-18042 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-16960 | Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure | |
| CVE-2026-75861 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction | |
| CVE-2026-80339 | Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80340 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80341 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assign | |
| CVE-2026-81741 | Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter | |
| CVE-2026-81022 | SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak | |
| CVE-2026-82185 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Rese | |
| CVE-2026-82848 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure | |
| CVE-2026-82184 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update | |
| CVE-2026-84113 | Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: SupportCandy
-
CVE-2026-81022
SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content -
CVE-2026-73350
WordPress SupportCandy plugin <= 3.5.1 - Broken Authenticati -
CVE-2026-57711
WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scriptin -
CVE-2026-54826
WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Obj -
CVE-2026-25321
WordPress SupportCandy plugin <= 3.4.4 - Broken Access Contr
Same vendor: Unknown
-
CVE-2026-82925
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Inje -
CVE-2026-81431
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributo -
CVE-2026-77770
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Opti -
CVE-2026-77771
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped -
CVE-2026-78361
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - U
V. Comments for CVE-2026-81021
No comments yet