{"id":"CVE-2026-15210","aliases":["EUVD-2026-53117","GHSA-gfjg-jw2h-6xcq"],"status":"published","title":"Login/Signup with Phone Number, OTP Verification \u003c 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force","description":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00418,"percentile":0.36528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-05T06:00:12Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"glboy","product":"otp login with phone number, otp verification"},{"vendor":"unknown","product":"otp login with phone number, otp verification"}],"references":[{"url":"https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15210"},{"url":"https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040"},{"url":"https://github.com/advisories/GHSA-gfjg-jw2h-6xcq"}],"sources":{"cve":[{"id":"CVE-2026-15210","title":"Login/Signup with Phone Number, OTP Verification \u003c 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force","description":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.","status":"published","published":"2026-08-05T06:00:12.055Z","modified":"2026-08-05T15:10:18.558Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-53117","description":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.","status":"published","published":"2026-08-05T06:00:12Z","modified":"2026-08-05T15:10:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:02:09.87889Z"}],"ghsa":[{"id":"GHSA-gfjg-jw2h-6xcq","title":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit...","description":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.","status":"published","published":"2026-08-05T09:31:14Z","modified":"2026-08-05T18:32:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:07.926015Z"}],"nvd":[{"id":"CVE-2026-15210","description":"The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.","status":"published","published":"2026-08-05T07:16:34.897Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:34.643497Z"}]}}