PT-2025-38633 · WordPress · Supportcandy+1

CVE-2025-10658 · Publicado 2025-09-20 · Atualizado 2025-09-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress versions up to and including 3.3.7

Description The SupportCandy plugin for WordPress is susceptible to authentication bypass due to missing rate limiting on One-Time Password (OTP) verification for guest login. This allows unauthenticated attackers to gain unauthorized access to customer support tickets by brute-forcing the 6-digit OTP code.

Recommendations Update the SupportCandy – Helpdesk & Customer Support Ticket System plugin to a version later than 3.3.7.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2025-10658

Produtos afetados

Supportcandy

Wordpress

Referências · 6

• https://plugins.trac.wordpress.org/changeset/3364335 · Nota
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820 · Nota
• https://t.me/CVEtracker/32992 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-10658 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve · Nota