Unauthenticated Broken Authentication in SupportCandy

Executive Summary

This is an unauthenticated broken authentication vulnerability in the WordPress SupportCandy Plugin versions 3.5.1 and below. It allows attackers to perform actions restricted to higher-privileged users without authentication, potentially gaining admin access to the website.

Useful 0 Not Useful 0

Detection Guidance

Check if the SupportCandy plugin version is 3.5.1 or below. Look for unauthorized admin actions or unusual user activity. Use security plugins to scan for known indicators of compromise.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized admin access to your website, allowing them to take control of your site, modify content, steal data, or install malicious software. The high CVSS score of 8.2 indicates a significant risk of exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Update the SupportCandy plugin to version 3.5.2 or later immediately. Apply Patchstack's mitigation rule if available. Monitor for suspicious activity and restrict admin access.

Useful 0 Not Useful 0