WordPress security changelog
CRITICAL CVE-2026-15210 Received

OTP Login permits unauthenticated code brute force and account takeover

OTP Login With Phone Number, OTP Verification before 1.8.71 lets an unauthenticated visitor request a short numeric login code for an arbitrary account, does not rate-limit verification attempts and does not invalidate the code after an incorrect guess. An attacker can repeatedly guess the OTP and then log in as the targeted user, including an administrator. This unscored record received deeper review because it exposes an unauthenticated authentication-bypass path. The CNA does not disclose the request endpoints, actions or parameter names.

CVE / CNA score 9.1 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
OTP Login With Phone Number, OTP Verification
Plugin slug
otp-login-with-phone-number-otp-verification
Affected
< 1.8.71
Safe version
1.8.71
Published
Aug 05, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.

Update, patch or deactivate.

Update OTP Login With Phone Number, OTP Verification to 1.8.71 or later. Review OTP requests, failed verification attempts and privileged logins, and reset affected sessions or credentials if brute-force activity is present.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary and upstream sources