CVE-2026-94539

Name of the Vulnerable Software and Affected Versions SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent versions prior to 3.5.4

Description An issue exists where insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow authenticated attackers to perform time-based SQL Injection. This occurs via the sort by parameter, enabling attackers with custom-level access and above to append additional SQL queries to extract sensitive information from the database. Successful exploitation requires the attacker to possess a Subscriber-level (or higher) WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission configured.

Recommendations Update SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent to version 3.5.4 or later. As a temporary mitigation, restrict the 'Assign Agents' permission for SupportCandy Agent accounts to minimize the risk of exploitation.