CVE-2026-94539 psmplugins CVE debrief

Who should care

Defenders responsible for WordPress installations with the SupportCandy plugin should assess exposure and verify patching. This vulnerability requires attention from security teams, WordPress administrators, and developers who use the SupportCandy plugin.

Why it matters

CVE-2026-94539 is a medium-severity vulnerability in the SupportCandy plugin for WordPress that allows authenticated attackers to extract sensitive information from the database. Defenders should assess exposure, verify patching, and monitor database activity to mitigate potential risks.

• Potential data extraction from the database
• Increased risk of sensitive information disclosure
• Possible lateral movement within the network
• Verification of patching and configuration required

Technical summary

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Medium priority for defenders to assess exposure and verify patching, given the medium CVSS score and potential for data extraction.

Recommended defensive actions

• Assess exposure by checking if the SupportCandy plugin version is 3.5.3 or earlier
• Verify patching by updating to a patched version of the plugin
• Monitor database activity for suspicious queries
• Restrict access to the SupportCandy plugin to authorized users only
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by insufficient escaping on the user-supplied 'sort_by' parameter and lack of sufficient preparation on the existing SQL query. Exploitation requires a Subscriber-level or higher WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.