The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation because it does not verify that a request to reset a password is authorized, and it is identified as a CWE-288 authentication bypass flaw. Unauthenticated users who know a target’s phone number can invoke the plugin’s reset-password endpoint and set that user’s password to a one‑time‑password value, effectively taking over the account. This grants full access to any content or admin functions tied to the compromised user, enabling further exploitation.

All installations of the Orion SMS OTP Verification plugin version 1.1.7 and earlier are affected. No other vendors or products are listed. Any WordPress site that relies on these plugin versions for phone‑based authentication is at risk.

The CVSS score of 9.8 indicates critical severity, the EPSS score of < 1% suggests a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the plugin’s logic bypasses authentication entirely and only requires knowledge of a phone number, the exploit path is simple and could be executed by an unauthenticated attacker with minimal information. The ability to assume any user account presents a high risk to site integrity and confidentiality.