What is the CVSS score of CVE-2025-9967?

CVE-2025-9967 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2025-9967?

The WordPress Orion SMS OTP Verification plugin (versions 1.1.7 and earlier) contains a critical account takeover vulnerability that allows attackers to reset any user's password using only a phone…

How to fix or mitigate CVE-2025-9967?

Within 24 hours: Disable or deactivate the Orion SMS OTP Verification plugin on all WordPress installations. Audit access logs for suspicious password reset activity within the past 30 days. Within 7 days: Verify all user accounts, especially administrators, have not been compromised; consider forcing password resets for all users. Contact the plugin vendor for remediation timeline or migrate to an alternative OTP solution. Within 30 days: Replace the plugin with a patched version (if released) or implement an alternative SMS/OTP authentication method that has undergone security review.

WordPress CVE-2025-9967

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2025-10-15 security@wordfence.com

WordPress Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number

AnalysisAI

Account takeover in WordPress Orion SMS OTP Verification plugin (versions ≤1.1.7) allows unauthenticated remote attackers to reset arbitrary user passwords without identity verification. Attackers knowing a target's phone number can change that user's password to an attacker-controlled OTP, gaining complete account access with full privileges. CVSS 9.8 (Critical) reflects network-accessible, no-authentication-required exploitation with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Technical ContextAI

CWE-288 authentication bypass stems from insufficient identity verification in password reset workflow (reset-password.js). Plugin accepts OTP-based password changes without validating requester legitimacy, allowing phone number enumeration to drive takeover. CVSS vector AV:N/AC:L/PR:N indicates trivial remote exploitation with no authentication barrier or user interaction required.

Affected ProductsAI

WordPress Orion SMS OTP Verification plugin, vendor Orion, all versions through 1.1.7 inclusive. Applicable CPE (if enumerated): cpe:2.3:a:orion:orion_sms_otp_verification:*:*:*:*:*:wordpress:*:* with version range ending at 1.1.7.

RemediationAI

No vendor-released patch identified at time of analysis. Plugin repository shows no commits post-vulnerability disclosure per https://plugins.trac.wordpress.org/log/orion-sms-otp-verification/. Immediately deactivate and remove Orion SMS OTP Verification plugin from all WordPress installations. Conduct user account audit for unauthorized password resets or suspicious authentication activity. Monitor Wordfence threat intelligence https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve for vendor response. If OTP functionality is mission-critical, migrate to actively maintained alternatives with verified identity validation (e.g., two-factor plugins supporting TOTP/U2F). Restrict administrative account phone numbers from public exposure to limit attack surface until patched version becomes available.