What is the CVSS score of CVE-2026-8760?

CVE-2026-8760 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Login with OTP are affected by CVE-2026-8760?

The Login with OTP plugin for WordPress (all versions through 1.6) contains a critical authentication bypass that allows unauthenticated attackers to gain full administrative access to affected…

How to fix or mitigate CVE-2026-8760?

Within 24 hours: Deactivate and remove the Login with OTP plugin (v1.6 and below) from all WordPress installations; audit access logs for suspicious authentication activity. Within 7 days: Monitor the plugin vendor's security advisories for patch availability; evaluate alternative OTP authentication solutions as contingencies. Within 30 days: Deploy the vendor-released patch to all WordPress instances once available and tested, or complete migration to an alternative OTP provider if patch timeline is unacceptable.

Login with OTP CVE-2026-8760

EUVD-2026-32084 CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-05-27 security@wordfence.com

GHSA-cq2x-2xjr-vm5v

Authentication Bypass WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:44 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otpl_login_action() was placed only inside the OTP-generation branch and is never evaluated on the OTP-validation branch, and the generated 6-digit OTP additionally has no expiration. This makes it possible for unauthenticated attackers to brute-force the 900,000-value OTP space for any user account (including administrators) and obtain a valid wp_set_auth_cookie() session, leading to full site compromise.

AnalysisAI

Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthenticated attackers log in as any user, including administrators. The flaw is an incomplete fix for CVE-2024-11178: the brute-force lockout was added only to the OTP-generation code path and never checked when an OTP is validated, and the 6-digit codes never expire, so an attacker can exhaustively guess the ~900,000-value OTP space and receive a valid WordPress session cookie. CVSS is 9.8; this is rated unauthenticated (CVSS PR:N) with low attack complexity, but there is no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

The plugin replaces or augments WordPress login with a one-time password sent to the user. The vulnerable logic lives in the otpl_login_action() handler (see the referenced WordPress.org Trac source for tag 1.6 and trunk, otpl-class.php lines 361/419/424/427). The previous fix for CVE-2024-11178 introduced a rate-limit/lockout counter, but it was placed inside the branch that generates and sends a new OTP rather than the branch that verifies a submitted OTP. Because verification is never gated by the lockout, an attacker can submit unlimited validation attempts. This maps to CWE-307 (Improper Restriction of Excessive Authentication Attempts) - the root cause class where an authentication mechanism fails to throttle or lock out repeated guesses. A second design weakness compounds it: the generated 6-digit OTP has no expiration, so the target value stays valid indefinitely, removing any time pressure on the brute-force loop. A successful guess causes the plugin to call wp_set_auth_cookie(), minting a fully authenticated session for the chosen account.

RemediationAI

No vendor-released patch version is identified in the available data - the description states all versions through 1.6 are vulnerable and no fixed release number is provided - so monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ad22cb24-e6a0-456f-afe8-88a39acd97d3?source=cve) and the plugin's WordPress.org page and upgrade to the first version that explicitly remediates CVE-2026-8760 as soon as it is published. Until a fix is confirmed, the most effective compensating control is to deactivate the Login with OTP plugin, which removes the vulnerable OTP login path entirely but disables OTP-based authentication for all users; if OTP cannot be removed, restrict access to the login endpoint (wp-login.php and the plugin's OTP-validation request) using a WAF or server-level IP allowlisting and add aggressive rate-limiting/lockout rules at the WAF to externally enforce the throttling the plugin omits - note this can block legitimate users behind shared NAT/proxies and does not fix the missing OTP expiration. As a defense for high-value accounts, rotate administrator credentials and audit for unexpected sessions or new admin users created during the exposure window.