OTP Login With Phone Number CVE-2026-15210

The target WordPress site must have the "OTP Login With Phone Number, OTP Verification" plugin (version < 1.8.71) installed and its OTP/phone login flow enabled, because exploitation abuses that specific verification endpoint. The concrete prerequisites are: the plugin allows an unauthenticated user to request a login code for an arbitrary account, the OTP is short and numeric, and the plugin neither limits verification attempts nor invalidates the code after a wrong guess - all three combine to make brute-force feasible. There is no authentication requirement (PR:N), no user interaction (UI:N), and network reachability to the login endpoint is sufficient (AV:N/AC:L). The primary limiting factor is deployment scope: only sites actually running this plugin as a login mechanism are exploitable; sites that do not use the OTP login feature are not affected. External rate-limiting (WAF, CDN) in front of the login endpoint would also raise the practical difficulty.

Signals conflict in an informative way. The CVSS vector (AV:N/AC:L/PR:N/UI:N, score 9.1) and the described logic - unauthenticated OTP request plus unlimited brute-force - indicate a genuinely low-barrier, high-impact account-takeover primitive, and a public POC exists via WPScan. Against that, EPSS is only 0.15% (4th percentile) and the CVE is not on CISA KEV, indicating no evidence of widespread active exploitation yet; low EPSS for a fresh, POC-backed WordPress auth bypass often reflects limited observation time rather than low true exploitability. Real-world priority should be treated as high for any site actually running this plugin as a login mechanism, because exploitation is scriptable and requires no privileges or user interaction. No contradictions between vector and description were found - the network, unauthenticated framing is internally consistent. Availability impact is correctly rated N, so this is a confidentiality/integrity (takeover) issue, not a denial-of-service.

An unauthenticated attacker submits a request for a login OTP targeting the administrator account, then scripts repeated verification submissions against the short numeric code without being rate-limited or having the code invalidated on wrong guesses. Because the keyspace is small and guessing is unlimited, the attacker brute-forces the correct OTP within a feasible number of attempts and obtains an authenticated admin session. A public POC exists via WPScan, and the low CVSS attack complexity (AC:L) with no required privileges or user interaction makes this readily automatable.