CVE-2025-10658 is an authentication bypass vulnerability in the SupportCandy WordPress plugin caused by the absence of rate limiting on one-time password (OTP) verification during guest login. Attackers can brute force the 6-digit OTP code without restriction, enabling unauthorized access to customer support tickets. This vulnerability affects all versions up to and including 3.3.7. The weakness is categorized under CWE-307, which involves improper restriction of excessive authentication attempts. The CVSS score of 6.5 reflects a network attack vector with low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to bypass authentication controls by brute forcing OTP codes, leading to unauthorized access to customer support tickets. This compromises the confidentiality and integrity of sensitive customer data handled by the SupportCandy plugin. There is no indication of availability impact. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing external rate limiting or additional authentication controls on the OTP verification process to reduce brute force risk.