The Orion Login with SMS plugin for WordPress allows an unauthenticated attacker to bypass authentication, because the olws_handle_verify_phone() function uses a weak one‑time password algorithm, exposes the hash needed to generate the OTP, and imposes no limit on OTP submission attempts. If an attacker can identify a user’s phone number, they can log in as that user, including administrators. This flaw directly compromises the confidentiality and integrity of the site, potentially allowing full control over the WordPress instance.

WordPress sites running the Orion Login with SMS plugin version 1.0.5 or earlier, developed by gsayed786.

The vulnerability carries a CVSS score of 8.1, indicating high severity. The EPSS score is below 1%, suggesting that actual exploitation is currently low, and the flaw is not listed in CISA’s KEV catalog. Attacks would likely be performed remotely via the WordPress login interface, and can succeed without any additional privileges if the attacker can obtain a target’s phone number. The lack of attempt limits further eases exploitation. Overall, the risk is significant due to the high impact, though the exploitation probability remains limited at present.