CVE-2025-10658

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10658", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-17T21:59:39.750Z", "datePublished": "2025-09-20T06:43:18.759Z", "dateUpdated": "2026-04-08T16:43:37.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:37.459Z"}, "affected": [{"vendor": "psmplugins", "product": "SupportCandy \u2013 Helpdesk & Customer Support Ticket System", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SupportCandy \u2013 Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code."}], "title": "SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820"}, {"url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348"}, {"url": "https://plugins.trac.wordpress.org/changeset/3364335/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "cweId": "CWE-307", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-09-18T05:31:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-19T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T15:01:39.741963Z", "id": "CVE-2025-10658", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T15:01:56.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10658", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-22T15:01:39.741963Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T15:01:43.460Z"}}], "cna": {"title": "SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "psmplugins", "product": "SupportCandy \u2013 Helpdesk & Customer Support Ticket System", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.3.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-18T05:31:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-19T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820"}, {"url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348"}, {"url": "https://plugins.trac.wordpress.org/changeset/3364335/"}], "descriptions": [{"lang": "en", "value": "The SupportCandy \u2013 Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-20T06:43:18.759Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10658", "state": "PUBLISHED", "dateUpdated": "2025-09-22T15:01:56.425Z", "dateReserved": "2025-09-17T21:59:39.750Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-20T06:43:18.759Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SupportCandy \u2013 Helpdesk & Customer Support Ticket System", "vendor": "psmplugins", "versions": [{"lessThanOrEqual": "3.3.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SupportCandy \u2013 Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code."}], "id": "CVE-2025-10658", "lastModified": "2026-06-17T08:28:42.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10658", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-22T15:01:39.741963Z", "version": "2.0.3"}}]}, "published": "2025-09-20T07:15:35.607", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3364335/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T23:48:11.630813+00:00", "value": {"mitigation_remediation": ["Apply any available vendor patch or update for the SupportCandy plugin.", "Enable and enforce rate limiting on the OTP verification endpoint to restrict the number of attempts per IP or user.", "Restrict access to the OTP verification endpoint to authenticated, logged\u2011in users only by configuring appropriate access controls.", "Monitor server logs for repeated failed OTP attempts and configure automated blocking or alerting for suspicious activity."], "summary": {"action": "Patch Now", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "All installations of the SupportCandy plugin for WordPress with versions up to and including 3.3.7 are affected. No other versions are listed as vulnerable.", "description_and_impact": "The vulnerability arises from missing rate limiting on the OTP verification used by the SupportCandy Helpdesk & Customer Support Ticket System plugin in WordPress. An unauthenticated attacker can brute force the 6\u2011digit OTP code and bypass authentication, gaining unauthorized access to customer support tickets. This allows access to potentially sensitive support requests and customer data, violating confidentiality and integrity protections. The weakness is classified as CWE\u2011307 (Improper Restriction of Excessive Authentication Attempts).", "risk_and_exploitability": "The CVSS score of 6.5 places the flaw in the medium severity range, and the EPSS score of less than 1% suggests a low current exploitation probability. The plugin is not listed in the CISA KEV catalog. The exploitation path is straightforward: an attacker can submit OTP attempts without prior authentication, so the attack requires only knowledge of the OTP endpoint and the length of the code. Because the code is only six digits and rate limiting is absent, brute force is feasible with automated tools, though the low EPSS indicates that active exploitation is currently uncommon."}}}}, "created": "2025-09-22T09:58:53.197478+00:00", "updated": "2026-04-28T00:00:18.099280+00:00", "vendors": ["supportcandy", "supportcandy$PRODUCT$supportcandy", "wordpress", "wordpress$PRODUCT$wordpress"]}