OTP Login permits unauthenticated code brute force and account takeover
OTP Login With Phone Number, OTP Verification before 1.8.71 lets an unauthenticated visitor request a short numeric login code for an arbitrary account, does not rate-limit verification attempts and does not invalidate the code after an incorrect guess. An attacker can repeatedly guess the OTP and then log in as the targeted user, including an administrator. This unscored record received deeper review because it exposes an unauthenticated authentication-bypass path. The CNA does not disclose the request endpoints, actions or parameter names.
- Component
- OTP Login With Phone Number, OTP Verification
- Plugin slug
otp-login-with-phone-number-otp-verification- Affected
- < 1.8.71
- Safe version
1.8.71- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update OTP Login With Phone Number, OTP Verification to 1.8.71 or later. Review OTP requests, failed verification attempts and privileged logins, and reset affected sessions or credentials if brute-force activity is present.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N