A vulnerability, which was classified as critical, was found in SupportCandy Plugin up to 3.4.4 on WordPress. Impacted is the function
add_reply. The manipulation of the argument description_attachments results in improper control of resource identifiers.
This vulnerability is known as CVE-2026-1251. It is possible to launch the attack remotely. No exploit is available.
