The Login with OTP plugin for WordPress contains a flaw in the OTP validation flow that bypasses the rate‑limit check introduced in a prior fix. Because the check is only applied when generating an OTP, every attempt to validate a user’s one‑time password is accepted as long as the code matches a 6‑digit value. The code is never limited in time or number of attempts, presenting 900,000 possibilities that an unauthenticated attacker can brute‑force. An attacker who succeeds can obtain a ‘wp_set_auth_cookie()’ session and gain the privileges of the targeted account, including administrators, thereby achieving full site compromise. This is an example of CWE‑307, enforcement of authentication bypass.

The vulnerability affects the WordPress plugin Login with OTP, authored by india‑web‑developer. All released versions up to and including 1.6 are impacted. Adopting a plain‑text understanding, WordPress site administrators using role‑based access to the WordPress admin dashboard are the most likely target audience for this flaw.

The severity of this issue is high, with a CVSS score of 9.8. EPSS data is not available, although the lack of a rate limit and the possibility of automated brute‑force usage suggests a potentially high exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Inference indicates that an attacker can exploit the flaw remotely by repeatedly calling the OTP validation endpoint over HTTP/HTTPS, attempting candidate codes until the correct one is found. Once accepted, the attacker receives a valid authentication cookie and can operate with the victim’s privileges.