Executive Summary
A critical vulnerability, CVE-2026-15210, with a CVSS score of 9.1, affects the OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71. This vulnerability allows an unauthenticated attacker to brute-force OTP login codes, potentially leading to account takeover, including administrator accounts.
Technical Analysis
The vulnerability class is an authentication bypass due to insufficient rate limiting and lack of invalidation of one-time login codes after incorrect guesses. The attack vector involves an unauthenticated user requesting a login code for any account via the plugin's OTP verification mechanism. The root cause is the plugin's failure to limit the number of OTP verification attempts and to invalidate a one-time login code after a wrong guess.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by requesting a login code for a target account. The attacker can then brute-force the short numeric OTP code, as the plugin does not limit the number of attempts or invalidate the code after incorrect guesses. Once the correct code is guessed, the attacker gains control of the account, potentially allowing for actions such as escalating privileges or accessing sensitive information.
Impact Assessment
The affected product is the OTP Login With Phone Number, OTP Verification WordPress plugin in versions prior to 1.8.71. The potential impact includes account takeover (including administrator accounts), leading to confidentiality and integrity impacts. The CVSS score of 9.1 indicates a critical severity level.
Recommended Actions
To mitigate this vulnerability, update the OTP Login With Phone Number, OTP Verification WordPress plugin to version 1.8.71 or later immediately. Additionally, monitor for suspicious login attempts and consider implementing additional security measures such as IP blocking or rate limiting on login attempts.
Sources
- National Vulnerability Database (NVD)
- WPScan