CVE-2025-10658

MEDIUM

SupportCandy <= 3.3.7 - Unauthenticated Authentication Bypass via OTP Brute Force

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-10658. PoCs published by jFriedli.

AI-analyzed exploit summary This repository contains a functional Python script that exploits CVE-2025-10658 by brute-forcing the OTP (One-Time Password) in SupportCandy's guest login flow, leading to account takeover. The script automates the extraction of required values and systematically tests OTP codes.

Description

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-10658

This repository contains a functional Python script that exploits CVE-2025-10658 by brute-forcing the OTP (One-Time Password) in SupportCandy's guest login flow, leading to account takeover. The script automates the extraction of required values and systematically tests OTP codes.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: SupportCandy (WordPress plugin)
No auth needed
Prerequisites: Access to the target WordPress site with SupportCandy installed · Ability to initiate the OTP login flow · Extracted OTP_ID and nonce values from the OTP form
devstral-2 · analyzed Apr 28, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0032
EPSS Percentile 23.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-307
Status published
Products (1)
psmplugins/SupportCandy – Helpdesk & Customer Support Ticket System < 3.3.7
Published Sep 20, 2025
Tracked Since Feb 18, 2026