Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-24839. PoCs published by tomorroisnew.
Description
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Exploits (1)
github
NO CODE
2 stars
by tomorroisnew · poc
https://github.com/tomorroisnew/CVE/tree/main/CVE-2021-24839
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/5e6e63c2-2675-4b8d-9b94-c16c525a1a0e
Scores
CVSS v3
7.5
EPSS
0.0122
EPSS Percentile
64.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-862
Status
published
Products (1)
supportcandy/supportcandy
< 2.2.5
Published
Feb 07, 2022
Tracked Since
Feb 18, 2026