V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsDocs
CVE-2025-10658
ANC
MediumConfirmedExploit available

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up…

CVSS
6.5
Medium
EPSS
0.01
p68
Published
2025-01-01
Updated
2025-01-01
Description

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.

Tags · CWE
Pre-auth
CWE-307
CAPEC-16
CAPEC-49
CAPEC-560
CAPEC-565
CAPEC-600
CAPEC-652
CAPEC-653
Affected products
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Timeline
2025-01-01
Published
2025-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: L
Low (L)
Integrity Impact
I: L
Low (L)
Availability Impact
A: N
None (N)
Exploit indicators
EPSS
0.006 · p68
Known exploited (KEV)
No
MITRE ATT&CK
Inferred via CAPEC
└ via CAPEC-560 · CWE-307
└ via CAPEC-49 · CWE-307
└ via CAPEC-565 · CWE-307
└ via CAPEC-600 · CWE-307
└ via CAPEC-652 · CWE-307
Known exploits — Сканер-ВС
CVE-2025-10658
github-poc · https://github.com/jFriedli/CVE-2025-10658
Enterprise
Affected software
ProductVendorStatus
Tracked
Source databases
ANC