CVE-2025-9967
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
Analysis
Account takeover in WordPress Orion SMS OTP Verification plugin (versions ≤1.1.7) allows unauthenticated remote attackers to reset arbitrary user passwords without identity verification. Attackers knowing a target's phone number can change that user's password to an attacker-controlled OTP, gaining complete account access with full privileges. CVSS 9.8 (Critical) reflects network-accessible, no-authentication-required exploitation with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Technical Context
CWE-288 authentication bypass stems from insufficient identity verification in password reset workflow (reset-password.js). Plugin accepts OTP-based password changes without validating requester legitimacy, allowing phone number enumeration to drive takeover. CVSS vector AV:N/AC:L/PR:N indicates trivial remote exploitation with no authentication barrier or user interaction required.
Affected Products
WordPress Orion SMS OTP Verification plugin, vendor Orion, all versions through 1.1.7 inclusive. Applicable CPE (if enumerated): cpe:2.3:a:orion:orion_sms_otp_verification:*:*:*:*:*:wordpress:*:* with version range ending at 1.1.7.
Remediation
No vendor-released patch identified at time of analysis. Plugin repository shows no commits post-vulnerability disclosure per https://plugins.trac.wordpress.org/log/orion-sms-otp-verification/. Immediately deactivate and remove Orion SMS OTP Verification plugin from all WordPress installations. Conduct user account audit for unauthorized password resets or suspicious authentication activity. Monitor Wordfence threat intelligence https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve for vendor response. If OTP functionality is mission-critical, migrate to actively maintained alternatives with verified identity validation (e.g., two-factor plugins supporting TOTP/U2F). Restrict administrative account phone numbers from public exposure to limit attack surface until patched version becomes available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today