Description
Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PSM Plugins | SupportCandy | ≤ 3.4.6 | — |
High · 7.6
CVE-2026-54826
EUVD-2026-39673GHSA-6mpj-cp6h-6c54
WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability
Published Jun 26, 2026 · Updated Jun 29, 2026 · Assigned by Patchstack