CVE-2026-25321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25321", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:20:47.811Z", "datePublished": "2026-02-19T08:26:55.525Z", "dateUpdated": "2026-04-28T16:14:54.916Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "supportcandy", "product": "SupportCandy", "vendor": "PSM Plugins", "versions": [{"changes": [{"at": "3.4.5", "status": "unaffected"}], "lessThanOrEqual": "3.4.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:03.972Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects SupportCandy: from n/a through <= 3.4.4.</p>"}], "value": "Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.916Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:30:18.342553Z", "id": "CVE-2026-25321", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:57:58.321Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:30:18.342553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:30:09.044Z"}}], "cna": {"title": "WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PSM Plugins", "product": "SupportCandy", "versions": [{"status": "affected", "changes": [{"at": "3.4.5", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.4.4"}], "packageName": "supportcandy", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:05:03.972Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-4-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects SupportCandy: from n/a through <= 3.4.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.916Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25321", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:14:54.916Z", "dateReserved": "2026-02-02T12:20:47.811Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:55.525Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "supportcandy", "product": "SupportCandy", "vendor": "PSM Plugins", "versions": [{"changes": [{"at": "3.4.5", "status": "unaffected"}], "lessThanOrEqual": "3.4.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4."}, {"lang": "es", "value": "Vulnerabilidad por ausencia de autorizaci\u00f3n en PSM Plugins SupportCandy supportcandy permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a SupportCandy: desde n/a hasta &lt;= 3.4.4."}], "id": "CVE-2026-25321", "lastModified": "2026-06-17T10:24:25.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25321", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:30:18.342553Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:16.483", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.4.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SupportCandy", "source": "cna", "vendor": "PSM Plugins"}, "product": "supportcandy", "vendor": "psm_plugins"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T06:36:08.297111+00:00", "value": {"mitigation_remediation": ["Upgrade the SupportCandy plugin to the latest version (currently 3.4.5 or newer) to remove the broken access control flaw.", "Verify that only appropriate roles (e.g., administrators or support staff) have permissions to access the support ticket functions within the plugin settings.", "If an upgrade is not immediately possible, disable the plugin or move the site into maintenance mode until the patch can be applied."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin SupportCandy by PSM Plugins, version 3.4.4 and all earlier releases. The issue applies to any site running the plugin in these versions, regardless of other site configuration.", "description_and_impact": "The vulnerability resides in the Authorization logic of the SupportCandy plugin for WordPress. An attacker can exploit incorrect access control settings to obtain privileges that the plugin should restrict, enabling them to view, edit, or delete support tickets and other sensitive data. The weakness is classified as CWE\u2011862, indicating a failure to enforce proper access restrictions.", "risk_and_exploitability": "The security scoring of 5.3 indicates medium severity for the plugin. The exploitation probability value of less than 1% shows a low likelihood of use in the wild, and this issue is not documented in the CISA KEV catalog. The attack vector is not explicitly defined in the description; however, the missing authorization suggests that any authenticated user with plugin access could exploit the flaw to elevate privileges, or an unauthenticated visitor might manipulate the plugin\u2019s interface if it exposes endpoints without proper checks. Given the moderate severity and low likelihood of exploitation, the overall risk to a site is moderate, but the potential confidentiality impact warrants timely remediation."}}}}, "created": "2026-02-20T10:09:02.492472+00:00", "updated": "2026-04-16T06:45:16.310398+00:00", "vendors": ["psm_plugins", "psm_plugins$PRODUCT$supportcandy", "wordpress", "wordpress$PRODUCT$wordpress"]}