Authentication Bypass in Orion Login with SMS Plugin for WordPress

CVE-2025-7692

What is CVE-2025-7692?

The Orion Login with SMS plugin for WordPress is prone to an authentication bypass vulnerability. All versions up to 1.0.5 are affected, as the olws_handle_verify_phone() function fails to implement a robust OTP validation mechanism. Attackers can exploit this weakness by accessing the exposed hash necessary for generating OTPs, allowing them to bypass authentication. Additionally, the absence of restrictions on the number of code submission attempts permits unauthorized users to gain access to other accounts, including those of administrators, by simply knowing their phone numbers.

References