CVE-2023-2719: SupportCandy < 3.1.7 - Subscriber+ SQLi

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-19 · updated 2026-06-17

Description

The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.

Affected products

SupportCandy: before 3.1.7 — fixed in 3.1.7

How to fix

Upgrade to a fixed version: SupportCandy 3.1.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35
https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35
https://wpscan.com/vulnerability/d9f6f4e7-a237-49c0-aba0-2934ab019e35/

Get alerted when CVE-2023-2719 or the next vulnerability affects your stack