CVE-2026-54826 — WordPress SupportCandy plugin

CVE-2026-54826 is associated with CWE-639: authorization bypass through a user-controlled key. The source describes a Subscriber Insecure Direct Object Reference (IDOR) vulnerability in SupportCandy versions 3.4.6 and earlier.