CVE-2026-15210

9.1 CRITICAL

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows unauthenticated users to brute-force OTP codes for any account, potentially taking over administrator accounts.
Exploitability: Exploitation is relatively easy due to the lack of rate limiting or code invalidation after failed attempts.
Blast radius: If exploited, it could lead to complete compromise of user and admin accounts on affected WordPress sites.
Prioritized remediation: Update the OTP Login With Phone Number plugin to version 1.8.71 or later immediately.

auth-bypassbrute-forcewordpressotptoken

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-287

All references

https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.