| Package | Affected versions | Patched versions |
|---|---|---|
| supportcandy | < 3.1.7 | 3.1.7 |
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free