CVE-2025-10658: SupportCandy WordPress Auth Bypass Flaw

CVE-2025-10658 Overview

CVE-2025-10658 affects the SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress in all versions up to and including 3.3.7. The vulnerability stems from missing rate limiting on the One-Time Password (OTP) verification flow used for guest login. Unauthenticated attackers can brute force the 6-digit OTP code and gain unauthorized access to customer support tickets. The weakness is classified under [CWE-307: Improper Restriction of Excessive Authentication Attempts]. The issue was addressed in the plugin repository via changeset 3364335.

Critical Impact
Unauthenticated attackers can bypass guest authentication and access customer support tickets containing potentially sensitive personal and technical information.

Affected Products

SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress
All plugin versions up to and including 3.3.7
WordPress sites exposing SupportCandy guest login functionality

Discovery Timeline

2025-09-20 - CVE-2025-10658 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10658

Vulnerability Analysis

SupportCandy allows unauthenticated users to view and manage their own tickets through a guest login flow. The flow issues a 6-digit numeric OTP via email that the requester must submit to prove ownership of the mailbox associated with a ticket. The verification endpoint accepts submissions without any per-IP, per-email, or per-OTP throttling. Attackers can iterate through the full 6-digit keyspace (1,000,000 possibilities) at network speed. Given the small keyspace and network-based attack vector, brute force succeeds within a practical time window. Once verified, the attacker inherits the guest session tied to the targeted email address and can read and reply to that user's tickets.

Root Cause

The root cause is the absence of authentication attempt limiting on OTP validation. The vulnerable logic is exposed through the guest user handling in includes/class-wpsc-current-user.php and the OTP model in includes/models/class-wpsc-email-otp.php. Neither location enforces a maximum number of failed OTP submissions per token, per IP, or per session, and OTP tokens are not invalidated after a small number of failures. This aligns with [CWE-307].

Attack Vector

The attack requires only network access to a WordPress site running a vulnerable SupportCandy installation. An attacker submits a guest login request for a known or guessed customer email address, which triggers OTP generation. The attacker then automates POST requests to the OTP verification endpoint, cycling through candidate 6-digit values until the endpoint returns a successful response. Successful validation grants access to the ticket history associated with the target email address, disclosing conversation content and any attachments.

No public exploit code, proof-of-concept, or CISA Known Exploited Vulnerabilities Catalog listing is currently associated with CVE-2025-10658. The current EPSS probability is 0.318%.

Detection Methods for CVE-2025-10658

Indicators of Compromise

High volume of POST requests to the SupportCandy AJAX endpoint containing otp verification actions from a single source IP or a small set of IPs.
Repeated failed OTP verification responses followed by a successful verification for the same email address within a short window.
Access to ticket views by guest sessions originating from IP addresses or user agents that do not match prior activity for that customer email.

Detection Strategies

Enable verbose logging on the WordPress admin-ajax.php endpoint and alert when a single source generates more than a low threshold of OTP verification calls per minute.
Correlate WordPress access logs with the SupportCandy audit trail to identify guest sessions that produced many verification failures before a success.
Deploy a Web Application Firewall (WAF) rule that rate-limits requests to SupportCandy OTP-related actions and flags rapid, sequential numeric submissions.

Monitoring Recommendations

Ingest WordPress and reverse proxy logs into a centralized logging or SIEM platform and build dashboards for SupportCandy endpoint request rates.
Alert on anomalous ticket read activity, such as a single IP accessing tickets from many unrelated email addresses.
Review outbound email logs for spikes in guest OTP issuance messages, which can indicate reconnaissance against valid customer email addresses.

How to Mitigate CVE-2025-10658

Immediate Actions Required

Update the SupportCandy plugin to the version released via changeset 3364335 or later, which addresses the missing rate limiting.
Audit ticket access logs for the period preceding the update to identify suspicious guest sessions or high-volume OTP verification activity.
Reset or invalidate any active guest sessions and require re-verification for customers whose tickets contain sensitive data.

Patch Information

The maintainers addressed the issue in the SupportCandy repository via WordPress Changeset 3364335. The vulnerable code paths reviewed by researchers are documented in the class-wpsc-current-user.php source and the class-wpsc-email-otp.php source. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Restrict access to the SupportCandy guest login pages using an upstream WAF or reverse proxy rule that enforces strict rate limits per source IP.
Temporarily disable the guest login feature and require authenticated WordPress user accounts for ticket access until the update is applied.
Increase OTP length or complexity through custom code, and invalidate OTP tokens after a small number of failed verification attempts.

bash

# Example NGINX rate limit for the WordPress AJAX endpoint
http {
    limit_req_zone $binary_remote_addr zone=wp_ajax:10m rate=10r/m;

    server {
        location = /wp-admin/admin-ajax.php {
            limit_req zone=wp_ajax burst=5 nodelay;
            include fastcgi_params;
            fastcgi_pass php_upstream;
        }
    }
}