The SupportCandy WordPress plugin prior to 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
supportcandy supportcandy |
Vulmon