CVE-2026-81021: CWE-200 Information Exposure in SupportCandy
Affects SupportCandySource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 10/25/2026, 04:40:14 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SupportCandy | Affected
| Fixed in
|
AI-suggested
Users should monitor the vendor's advisory for updates and apply any official fixes once released. Until then, consider restricting access to attachment download paths or disabling the affected functionality if feasible.
Description
The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.
Impact
The vulnerability exposes sensitive customer-uploaded attachments to unauthorized users, potentially leading to leakage of confidential information. There is no evidence of known exploits in the wild at this time.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.