Authentication Bypass in Login with OTP Plugin for WordPress

CVE-2026-8760

What is CVE-2026-8760?

The Login with OTP plugin for WordPress is susceptible to an authentication bypass due to an incomplete implementation of security measures. Specifically, the rate-limit and lockout checks incorporated into the OTP-generation code do not apply during the OTP-validation process. This oversight, combined with the absence of an expiration time for the generated 6-digit OTP, enables unauthorized attackers to exploit the 900,000 possible OTP values, allowing them to brute-force their way into any user account, including those of site administrators. Consequently, this could lead to a total compromise of the website.

References