The vulnerability arises from missing rate limiting on the OTP verification used by the SupportCandy Helpdesk & Customer Support Ticket System plugin in WordPress. An unauthenticated attacker can brute force the 6‑digit OTP code and bypass authentication, gaining unauthorized access to customer support tickets. This allows access to potentially sensitive support requests and customer data, violating confidentiality and integrity protections. The weakness is classified as CWE‑307 (Improper Restriction of Excessive Authentication Attempts).

All installations of the SupportCandy plugin for WordPress with versions up to and including 3.3.7 are affected. No other versions are listed as vulnerable.

The CVSS score of 6.5 places the flaw in the medium severity range, and the EPSS score of less than 1% suggests a low current exploitation probability. The plugin is not listed in the CISA KEV catalog. The exploitation path is straightforward: an attacker can submit OTP attempts without prior authentication, so the attack requires only knowledge of the OTP endpoint and the length of the code. Because the code is only six digits and rate limiting is absent, brute force is feasible with automated tools, though the low EPSS indicates that active exploitation is currently uncommon.