Privilege Escalation in Orion SMS OTP Verification Plugin for WordPress

CVE-2025-9967

What is CVE-2025-9967?

The Orion SMS OTP Verification plugin for WordPress has a security flaw that allows unauthorized attackers to escalate their privileges through account takeover. The vulnerability stems from inadequate user identity verification when updating passwords. Attackers who know a user's phone number can exploit this weakness to change the victim's password to a one-time password, thereby gaining unauthorized access to the victim's account. This issue affects all versions of the plugin up to and including 1.1.7, making it critical for website administrators to update to a secure version and mitigate potential risks.

References