Unauthorized Logins via OTP Validation Bypass

CVE-2024-9861

What is CVE-2024-9861?

The Miniorange OTP Verification with Firebase plugin for WordPress is susceptible to an authentication bypass issue present in versions up to and including 3.6.0. This vulnerability arises from inadequate validation of the token supplied during the one-time password (OTP) login process. As a result, attackers lacking valid credentials can exploit this weakness to gain unauthorized access to accounts, potentially including administrative privileges, by simply knowing the associated phone number of a targeted user.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References