Brute Force Vulnerability in OTP Login With Phone Number Plugin for WordPress
CVE-2026-15210
Currently unrated
What is CVE-2026-15210?
The OTP Login With Phone Number plugin for WordPress before version 1.8.71 is vulnerable as it lacks limitations on the number of OTP verification attempts. This oversight permits unauthorized users to continuously request login codes for any account without invalidating previous attempts. As the one-time passwords are short numeric codes, attackers can exploit this flaw through brute-force methods, potentially gaining control over targeted accounts, including those of administrators.
Affected Version(s)
OTP Login With Phone Number, OTP Verification 0 < 1.8.71
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.