CVE-2026-0683
SQL Injection in SupportCandy Plugin Allows Data Extraction
Publication date: 2026-01-31
Last updated on: 2026-01-31
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| supportcandy | supportcandy | to 3.4.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL Injection in the SupportCandy WordPress plugin (up to version 3.4.4) that occurs via the Number-type custom field filter. Due to insufficient escaping and preparation of user-supplied input when using the equals operator, authenticated users with Subscriber-level access or higher can append malicious SQL queries to existing database queries. This allows them to extract sensitive information from the database. [4]
How can this vulnerability impact me? :
The vulnerability allows authenticated users with low-level access (Subscriber and above) to perform unauthorized SQL queries on the database. This can lead to exposure of sensitive information stored in the database, potentially compromising user data and other confidential information managed by the SupportCandy plugin.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and analyzing AJAX requests related to the SupportCandy plugin's ticket filtering functionality, specifically those involving the Number-type custom field filter. Since the vulnerability involves SQL Injection via the equals operator on this numeric custom field, you can look for suspicious or malformed SQL payloads in requests made by authenticated users with Subscriber-level access or higher. Commands to detect this might include inspecting HTTP POST requests to AJAX endpoints handling ticket filters, for example using tools like curl or network monitoring tools to capture and analyze requests to the plugin's AJAX actions such as 'get_tickets'. Example command to capture such requests could be: `curl -X POST -d 'action=get_tickets&filters[number_field]=<payload>' https://yourwordpresssite.com/wp-admin/admin-ajax.php --cookie 'wordpress_logged_in=...'` where `<payload>` is a test input to check for SQL injection. Additionally, reviewing logs for unusual database errors or unexpected data exposure related to ticket queries may help detect exploitation attempts. [1, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the SupportCandy plugin to version 3.4.5 or later, where the vulnerability has been fixed. Until the update can be applied, restrict or monitor access to the ticket filtering functionality, especially for users with Subscriber-level access or higher. Implement web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the Number-type custom field filter. Additionally, review and tighten user permissions to limit who can access ticket filtering features. Applying security best practices such as input validation and escaping on user-supplied data in custom filters is essential, but the primary recommended action is to upgrade the plugin to the patched version. [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Subscriber-level access to perform SQL Injection attacks that can extract sensitive information from the database. Such unauthorized access and data extraction can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches. Therefore, exploitation of this vulnerability could compromise compliance with these standards by exposing sensitive user data. [1, 4]