CVE-2026-94539: SupportCandy plugin time-based SQL injection via sort_by parameter

Summary

The SupportCandy AI Customer Support Ticket System and Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL injection through the 'sort_by' parameter in all versions up to and including 3.5.3. The flaw stems from insufficient escaping of user-supplied input and a SQL query that is not sufficiently prepared. An authenticated attacker can append SQL queries to existing ones and extract sensitive information from the database. Exploitation requires a Subscriber-level or higher WordPress role and a SupportCandy Agent account with the 'Assign Agents' permission.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• CriticalCVE-2026-108263: Astron Agent code-node execution as root through workflow run endpointsSimilar attack · NVD/CVE Database
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSimilar attack · BleepingComputer
• CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading
• HighGHSA-cv3g-hj65-pcfh: PraisonAI: Shell command allowlist bypass via find -exec built-in actionSimilar attack · GitHub Advisory Database