EUVD-2026-53117
GHSA-gfjg-jw2h-6xcq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network brute-force of an unlimited, non-invalidated OTP gives full account takeover, so PR:N/UI:N/AC:L with C:H/I:H and A:N (no availability impact).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.
Articles & Coverage 1
AnalysisAI
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the "OTP Login With Phone Number, OTP Verification" plugin (version < 1.8.71) installed and its OTP/phone login flow enabled, because exploitation abuses that specific verification endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict in an informative way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a request for a login OTP targeting the administrator account, then scripts repeated verification submissions against the short numeric code without being rate-limited or having the code invalidated on wrong guesses. Because the keyspace is small and guessing is unlimited, the attacker brute-forces the correct OTP within a feasible number of attempts and obtains an authenticated admin session. … |
| Remediation | Patch available per vendor advisory: upgrade the plugin to version 1.8.71 or later, which is the first fixed release per the EUVD range (< 1.8.71). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all WordPress installations to identify which sites are running the vulnerable plugin (versions before 1.8.71) and assess their criticality and public exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today