CVE-2025-10658

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code.

• CWE-307

• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348
• https://plugins.trac.wordpress.org/changeset/3364335/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve

Published

Sep 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10651The Welcart e-Commerce plugin for WordPress is vulnerable to…5.5
• CVE-2025-10652The Robcore Netatmo plugin for WordPress is vulnerable to SQ…6.5
• CVE-2025-10653An unauthenticated debug port may allow access to the device…8.6
• CVE-2025-10655SQL Injection in Frappe HelpDesk in the dashboard get_dashbo…8.8
• CVE-2025-10656The Spreadsheet Price Changer for WooCommerce and WP E-comme…9.8
• CVE-2025-10657In a hardened Docker environment, with Enhanced Container Is…8.7
• CVE-2025-10659The Telenium Online Web Application is vulnerable due to a P…9.8
• CVE-2025-1066OpenPLC_V3 contains an arbitrary file upload vulnerability, …9.8
• CVE-2025-10660The WP Dashboard Chat plugin for WordPress is vulnerable to …6.5
• CVE-2025-10662A vulnerability has been found in SeaCMS up to 13.3. The imp…9.8
• CVE-2025-10663A vulnerability was found in PHPGurukul Online Course Regist…9.8
• CVE-2025-10664A vulnerability was determined in PHPGurukul Small CRM 4.0. …9.8