CVE-2025-4094 — Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

CVE-2025-4094

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing PUBLISHED

Description (CNA)

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

Affected (CNA)

Vendor / product	Versions
Unknown / DIGITS: WordPress Mobile Number Signup and Login	affected 0 before 8.4.6.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.