Otp Login With Phone Number Otp Verification
Monthly
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. Publicly available exploit code exists (reported by WPScan), though EPSS is low at 0.15% (4th percentile) and it is not in CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Authentication bypass in the OTP Login With Phone Number, OTP Verification WordPress plugin versions 1.8.50 through 1.8.60 allows unauthenticated remote attackers to log in as any user - including administrators - whose phone number is stored in user meta. The flaw stems from the Firebase OTP verification flow failing to bind the verified Firebase session to the phone number supplied in the request, so attackers can verify their own phone via Firebase and then submit a victim's number to be authenticated as that victim. No public exploit identified at time of analysis, but the trivial logic flaw and CVSS 9.8 score make this a critical priority.
Account takeover in the WordPress plugin "OTP Login With Phone Number, OTP Verification" before 1.8.71 stems from missing rate-limiting and non-invalidation of one-time login codes, letting an unauthenticated attacker request a login OTP for any account and brute-force the short numeric code to seize control of any user, including administrators. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation with high confidentiality and integrity impact. Publicly available exploit code exists (reported by WPScan), though EPSS is low at 0.15% (4th percentile) and it is not in CISA KEV, so there is no public exploit identified as actively exploited in the wild.
Authentication bypass in the OTP Login With Phone Number, OTP Verification WordPress plugin versions 1.8.50 through 1.8.60 allows unauthenticated remote attackers to log in as any user - including administrators - whose phone number is stored in user meta. The flaw stems from the Firebase OTP verification flow failing to bind the verified Firebase session to the phone number supplied in the request, so attackers can verify their own phone via Firebase and then submit a victim's number to be authenticated as that victim. No public exploit identified at time of analysis, but the trivial logic flaw and CVSS 9.8 score make this a critical priority.