CVE-2025-67598: CSRF in SupportCandy WordPress Plugin

The CSRF vulnerability in SupportCandy allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could permit an attacker to modify plugin settings, create or delete support tickets, or perform other actions within the plugin's functionality, all under the guise of the victim user. The blast radius depends on the permissions granted to the affected user within the SupportCandy plugin; an administrator account would grant the attacker significant control over the WordPress site's support features. While no direct precedent for SupportCandy exploitation is readily available, CSRF vulnerabilities are frequently exploited in WordPress plugins, often in conjunction with other vulnerabilities to escalate privileges.

1. Reserved2025-12-09
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67598 is to upgrade the SupportCandy plugin to version 3.4.2 or later. If immediate upgrading is not feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. These rules can help filter out malicious requests. Additionally, ensure that users are educated about the risks of clicking on suspicious links or visiting untrusted websites. Regularly review WordPress plugin configurations and permissions to minimize potential impact. After upgrade, confirm functionality by testing key SupportCandy features as a standard user and an administrator.

Active installs

10KNiche

Plugin rating