An authentication bypass vulnerability in the OTP Login With Phone Number WordPress plugin allows attackers to compromise any user account via brute-force of short verification codes.

This is an improper authentication vulnerability (CWE-287) caused by the absence of rate limiting on OTP verification attempts and a failure to invalidate codes after incorrect guesses. An unauthenticated attacker can brute-force the short numeric code to hijack any account, including administrative accounts.

With a critical CVSS score of 9.1, this vulnerability poses an existential risk to the application. Successful exploitation allows for complete account takeover, providing attackers with administrative access to the platform and the ability to exfiltrate sensitive data or modify application settings.

Immediate Action: Update the OTP Login With Phone Number, OTP Verification plugin to version 1.8.71 or later immediately.

Proactive Monitoring: Review authentication logs for an unusual volume of failed OTP verification attempts originating from single or multiple IP addresses.

Compensating Controls: Implement an account lockout policy or rate limiting at the WAF or application level to mitigate brute-force attempts while the update is pending.

Public Exploit Available: Yes, a public Proof-of-Concept is available.

This vulnerability is critical and requires immediate attention to prevent mass account takeover. Administrators must update the plugin immediately and audit recent login activity for signs of unauthorized access.