SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94539 · Microsoft / collected KEV context

cve-program · CVE-2026-94539

• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c105a36-452e-4fa7-9c8b-f142e1eb27aa?source=cve
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/class-wpsc-functions.php#L279
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/models/class-wpsc-agent.php#L370
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/models/class-wpsc-agent.php#L578
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.5.3/includes/admin/tickets/class-wpsc-ticket-list.php#L2367
• https://plugins.svn.wordpress.org/supportcandy/
• https://plugins.trac.wordpress.org/changeset/3718257/supportcandy/trunk/includes/models/class-wpsc-agent.php

No related operational record is retained in the current change model.