DIGITS WordPress Mobile Number Signup and Login OTP Bruteforce Vulnerability
Vulnerability
A vulnerability exists in the DIGITS: WordPress Mobile Number Signup and Login plugin in versions prior to 8.4.6.1. The issue arises because the plugin does not implement rate limiting on OTP validation attempts, allowing attackers to easily brute force OTPs.
Impact
Exploitation of this vulnerability could lead to unauthorized access by bypassing OTP verification, allowing attackers to manipulate user authentication processes.
Remediation
Users are advised to update the DIGITS WordPress Mobile Number Signup and Login plugin to version 8.4.6.1 or later.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
5.0exploitability
8.7remediation
7.7relevance
0.0threat
6.5urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.