The vulnerability resides in the Authorization logic of the SupportCandy plugin for WordPress. An attacker can exploit incorrect access control settings to obtain privileges that the plugin should restrict, enabling them to view, edit, or delete support tickets and other sensitive data. The weakness is classified as CWE‑862, indicating a failure to enforce proper access restrictions.

The affected product is the WordPress plugin SupportCandy by PSM Plugins, version 3.4.4 and all earlier releases. The issue applies to any site running the plugin in these versions, regardless of other site configuration.

The security scoring of 5.3 indicates medium severity for the plugin. The exploitation probability value of less than 1% shows a low likelihood of use in the wild, and this issue is not documented in the CISA KEV catalog. The attack vector is not explicitly defined in the description; however, the missing authorization suggests that any authenticated user with plugin access could exploit the flaw to elevate privileges, or an unauthenticated visitor might manipulate the plugin’s interface if it exposes endpoints without proper checks. Given the moderate severity and low likelihood of exploitation, the overall risk to a site is moderate, but the potential confidentiality impact warrants timely remediation.