{"id":"CVE-2025-4094","aliases":["EUVD-2025-16076","GHSA-vr5w-fmp9-m564"],"status":"published","title":"Digits \u003c 8.4.6.1 - Auth Bypass via OTP Bruteforcing","description":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.16566,"percentile":0.9703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2025-05-21T06:00:09Z","modified":"2026-06-17T09:32:29Z","exploits":[{"source":"exploitdb","id":"EDB-52307","title":"WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing","type":"webapps","platform":"multiple","date":"2025-05-29","url":"https://www.exploit-db.com/exploits/52307"},{"source":"pocgithub","id":"POCPioneer/CVE-2025-4094-POC","title":"POCPioneer/CVE-2025-4094-POC","date":"2025-05-15","url":"https://github.com/POCPioneer/CVE-2025-4094-POC"},{"source":"pocgithub","id":"starawneh/CVE-2025-4094","title":"starawneh/CVE-2025-4094","date":"2025-05-15","url":"https://github.com/starawneh/CVE-2025-4094"}],"products":[{"vendor":"unitedover","product":"digits"},{"vendor":"unknown","product":"digits: wordpress mobile number signup and login"}],"references":[{"url":"https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4094"},{"url":"https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb"},{"url":"https://github.com/advisories/GHSA-vr5w-fmp9-m564"}],"sources":{"cve":[{"id":"CVE-2025-4094","title":"Digits \u003c 8.4.6.1 - Auth Bypass via OTP Bruteforcing","description":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.","status":"published","published":"2025-05-21T06:00:09.025Z","modified":"2025-08-27T12:00:33.608Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-16076","description":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.","status":"published","published":"2025-05-21T06:00:09Z","modified":"2025-08-27T12:00:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:52.106571Z"}],"ghsa":[{"id":"GHSA-vr5w-fmp9-m564","title":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not...","description":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.","status":"published","published":"2025-05-21T21:31:36Z","modified":"2025-05-22T00:35:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:02:24.130786Z"}],"nvd":[{"id":"CVE-2025-4094","description":"The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.","status":"published","published":"2025-05-21T06:16:28.507Z","modified":"2026-06-17T09:32:29.48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:09.125937Z"}]}}