CVE-2025-10658

MEDIUM

SupportCandy - Auth Bypass

Title source: llm
STIX 2.1

Description

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-10658

Scores

CVSS v3 6.5
EPSS 0.0050
EPSS Percentile 66.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-307
Status published
Products (1)
psmplugins/SupportCandy – Helpdesk & Customer Support Ticket System < 3.3.7
Published Sep 20, 2025
Tracked Since Feb 18, 2026