Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-307.
Summary
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside the OTP-generation branch and is never evaluated on the OTP-validation branch, and the generated 6-digit OTP additionally has no expiration. This makes it possible for unauthenticated attackers to brute-force the 900,000-value OTP space for any user account (including administrators) and obtain a valid `wp_set_auth_cookie()` session, leading to full site compromise.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| india-web-developer | Login with OTP | up to 1.6 | — | No fix listed | CNA |
- Login with OTP Vendorindia-web-developer Affected up to 1.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8760
- 2026-10-03 Alias added: GHSA-cq2x-2xjr-vm5v
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
Other 10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ad22cb24-e6a0-456f-afe8-88a39acd97d3?source=cve
- https://plugins.trac.wordpress.org/browser/otp-login/tags/1.6/lib/otpl-class.php#L419
- https://plugins.trac.wordpress.org/browser/otp-login/trunk/lib/otpl-class.php#L419
- https://plugins.trac.wordpress.org/browser/otp-login/tags/1.6/lib/otpl-class.php#L424
- https://plugins.trac.wordpress.org/browser/otp-login/trunk/lib/otpl-class.php#L424
- https://plugins.trac.wordpress.org/browser/otp-login/tags/1.6/lib/otpl-class.php#L427
- https://plugins.trac.wordpress.org/browser/otp-login/trunk/lib/otpl-class.php#L427
- https://plugins.trac.wordpress.org/browser/otp-login/tags/1.6/lib/otpl-class.php#L361
- https://plugins.trac.wordpress.org/browser/otp-login/trunk/lib/otpl-class.php#L361
- https://nvd.nist.gov/vuln/detail/CVE-2024-11178
More india-web-developer vulnerabilities
- TI-2024-10353 Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP CVSS 3.1HIGH 8.1
- TI-2024-11682 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CVSS 3.1MEDIUM 6.4
- TI-2024-08834 SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta CVSS 3.1MEDIUM 6.4
Sources
- CVE-2026-8760 · CVE Program
- CVE-2026-8760 · NVD
- FIRST EPSS
- GHSA-cq2x-2xjr-vm5v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences