The SupportCandy plugin releases up to version 3.4.6 contain an Insecure Direct Object Reference flaw that allows an attacker to access subscriber information without proper authorization. This weakness means that anyone who can guess or infer subscriber identifiers can retrieve sensitive subscriber data. The vulnerability is identified as CWE‑639 and can directly compromise confidentiality by exposing subscriber details.

The affected product is the PSM Plugins SupportCandy WordPress plugin, versions up to and including 3.4.6. Sites running these versions are at risk because the plugin does not enforce proper access controls on subscriber identifiers.

The CVSS score of 7.6 indicates a high severity, and the likelihood of exploitation cannot be quantified due to the absence of publicly available probability data. The vulnerability is not listed in the CISA KEV catalogue, suggesting no confirmed large‑scale exploitation yet. The likely attack vector is through direct manipulation of URLs or API calls that reference subscriber IDs; this is inferred from the nature of the IDOR flaw as described.