Authentication Bypass in SupportCandy Plugin for WordPress

CVE-2025-10658

What is CVE-2025-10658?

The SupportCandy plugin for WordPress contains a significant vulnerability that allows unauthenticated attackers to bypass authentication mechanisms. This issue stems from the lack of rate limiting on the One-Time Password (OTP) verification process for guest logins. Without proper restrictions, attackers can use brute-force methods to exploit the OTP code, potentially gaining unwarranted access to customer support tickets and sensitive information. It is crucial for users of the plugin to ensure they upgrade to the latest version to safeguard against this vulnerability.

References