CVE-2026-15210 — Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

CVE-2026-15210

Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force PUBLISHED

Description (CNA)

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

Affected (CNA)

Vendor / product	Versions
Unknown / OTP Login With Phone Number, OTP Verification	affected 0 before 1.8.71

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.