CVE-2023-1730criticalCWE-89

CVE-2023-1730: critical vulnerability in SupportCandy

SupportCandy < 3.1.5 - Unauthenticated SQLi

Published · Updated

Follow this CVE+ Monitor SupportCandy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 41%
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · SupportCandy
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SupportCandy

In the same product, most dangerous first.

CVE-2023-2719HIGHSupportCandy < 3.1.7 - Subscriber+ SQLiEPSS 1.2%CVE-2023-2805—SupportCandy < 3.1.7 - Admin+ SQLiEPSS 0.9%CVE-2026-81022MEDIUMSupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code LeakEPSS 0.3%CVE-2026-81021MEDIUMSupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment DisclosureEPSS 0.3%