CVE-2026-1251 is an authorization bypass vulnerability in the SupportCandy WordPress plugin (up to version 3.4.4) caused by an insecure direct object reference in the 'add_reply' function. The plugin fails to validate a user-controlled key parameter ('description_attachments'), enabling authenticated users with subscriber-level privileges or higher to access and reassign file attachments belonging to other users. This flaw allows unauthorized access and modification of attachments by manipulating attachment IDs, violating access controls intended to protect user data.

The vulnerability allows authenticated users with low-level privileges to access and steal file attachments uploaded by other users. Attackers can re-associate these files to their own tickets, effectively removing access from the original owners. This results in unauthorized disclosure and modification of sensitive data stored as attachments within the helpdesk system. There is no indication of system availability impact or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to attachment access. Avoid granting unnecessary privileges to users and consider disabling or limiting the use of the 'add_reply' function if feasible.