The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress has a SQL injection flaw in its number-type custom field filter. The vulnerability arises because the plugin fails to properly escape user-supplied values when the equals operator is used, allowing attackers with authenticated access at the Subscriber level or higher to inject SQL code. This results in the ability to append arbitrary SELECT statements to the original query, thereby exposing sensitive data stored in the WordPress database. The weakness is a classic input validation error (CWE‑89).

Any site running the SupportCandy plugin version 3.4.4 or earlier, on a WordPress installation, is affected. The issue affects the default numbered custom fields used in ticket filtering. Affected users include any WordPress accounts with at least Subscriber rights, which is the minimum requirement to access the ticket list and apply filters.

The CVSS score is 6.5, indicating a moderate severity, and the EPSS score is below 1%, suggesting a low to moderate likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must already authenticate with sufficient privileges and then craft a filter query in the plugin’s interface to inject malicious SQL. Once executed, the attacker can read arbitrary tables or drop data, depending on the injected statement. No additional access or local execution is required beyond the existing account privileges.