SupportCandy – Helpdesk & Customer Support Ticket System Security & Risk Analysis

This analysis of SupportCandy v3.4.5 reveals a mixed security posture. While the plugin demonstrates good practices in output escaping (99%) and largely utilizes prepared statements for SQL queries (60%), significant concerns arise from its attack surface and historical vulnerability record. The presence of 135 unprotected AJAX handlers represents a substantial risk, offering potential entry points for attackers without proper authentication. The taint analysis shows a single flow with unsanitized paths, which, while not critical or high severity in this specific instance, warrants careful attention as it indicates a potential for injection vulnerabilities if not properly addressed in future updates.

The plugin's history of 16 known CVEs, including 2 critical and 3 high severity vulnerabilities, is a major red flag. The fact that there are currently no unpatched vulnerabilities is positive, but the sheer number and severity of past issues suggest a pattern of security weaknesses that have been exploited. The diversity of past vulnerability types, ranging from SQL Injection and Cross-Site Scripting to Authorization Bypass and Exposure of Sensitive Information, indicates that attackers have found various ways to compromise the plugin in the past. The last reported vulnerability in January 2026 (though this date seems in the future and might be a typo) suggests ongoing security challenges.

In conclusion, SupportCandy v3.4.5 has strengths in output handling and SQL query preparation. However, the large number of unprotected AJAX endpoints and the extensive history of critical and high-severity vulnerabilities create a significant security risk. Organizations using this plugin should exercise extreme caution, ensure all security updates are applied promptly, and consider the potential impact of past vulnerabilities being re-introduced.