Authentication Bypass in OTP Login Plugin for WordPress

CVE-2023-2706

What is CVE-2023-2706?

The OTP Login Woocommerce & Gravity Forms plugin for WordPress presents a significant security issue due to an authentication bypass vulnerability. When generating One-Time Password (OTP) codes for user login via phone number, the plugin inadvertently exposes these codes in an AJAX response. This flaw enables unauthorized attackers to retrieve sensitive login codes for administrator accounts, provided they can access the victim's configured phone number, potentially acquired through social engineering techniques or reconnaissance. This vulnerability compromises the authentication process, posing a serious risk to site security.

References