WordPress plugin
OTP Login With Phone Number, OTP Verification security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 18 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High7
- Medium8
- Low0
All OTP Login With Phone Number, OTP Verification vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Subscriber+) Account Takeover ≤1.8.78Update to 1.8.79 | CVE-2026-115967 | |
| High7.3 | Unauthenticated Privilege Escalation ≤1.8.77Update to 1.8.78 | CVE-2026-110373 | |
| Medium4.3 | Missing Authorization ≤1.8.77Update to 1.8.78 | CVE-2026-110374 | |
| Critical9.8 | OTP Brute Force ≤1.8.70Update to 1.8.71 | CVE-2026-65570 | |
| Critical9.8 | Unauthenticated Authentication Bypass via Firebase OTP Verification 1.8.50 – 1.8.60Update to 1.8.61 | CVE-2026-3655 | |
| High8.1 | Authentication Bypass ≤1.8.47Update to 1.8.48 | CVE-2025-8342 | |
| High8.8 | Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation ≤1.7.49Update to 1.7.50 | CVE-2024-6482 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.7.35Update to 1.7.36 | CVE-2024-37429 | |
| High8.1 | Insecure Password Reset Mechanism ≤1.7.34Update to 1.7.35 | CVE-2024-6125 | |
| Critical9.8 | Authentication Bypass due to Missing Empty Value Check ≤1.7.26Update to 1.7.27 | CVE-2024-5150 | |
| Medium4.3 | Missing Authorization ≤1.7.18Update to 1.7.20 | CVE-2024-34371 | |
| Medium5.3 | Missing Authorization ≤1.6.93Update to 1.6.94 | CVE-2024-32832 | |
| High8.8 | Unauthorized Account Password Change to Privilege Escalation ≤1.7.16Update to 1.7.17 | CVE-2024-32507 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.6.93Update to 1.6.94 | CVE-2024-31424 | |
| High8.8 | Cross-Site Request Forgery to User Password Change ≤1.5.6Update to 1.5.7 | CVE-2023-4916 | |
| Medium6.1 | Reflected Cross-Site Scripting <1.4.2Update to 1.4.2 | CVE-2023-23492 | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting ≤1.3.7Update to 1.3.8 | CVE-2022-0598 | |
| Medium6.5 | Unauthenticated Remote Plugin Deletion <1.3.7Update to 1.3.7 | CVE-2022-0593 |
- High8.8Authenticated (Subscriber+) Account Takeover
≤1.8.78Update to 1.8.79
- High7.3Unauthenticated Privilege Escalation
≤1.8.77Update to 1.8.78
- Medium4.3Missing Authorization
≤1.8.77Update to 1.8.78
- Critical9.8OTP Brute Force
≤1.8.70Update to 1.8.71
- Critical9.8Unauthenticated Authentication Bypass via Firebase OTP Verification
1.8.50 – 1.8.60Update to 1.8.61
- High8.1Authentication Bypass
≤1.8.47Update to 1.8.48
- High8.8Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
≤1.7.49Update to 1.7.50
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.7.35Update to 1.7.36
- High8.1Insecure Password Reset Mechanism
≤1.7.34Update to 1.7.35
- Critical9.8Authentication Bypass due to Missing Empty Value Check
≤1.7.26Update to 1.7.27
- Medium4.3Missing Authorization
≤1.7.18Update to 1.7.20
- Medium5.3Missing Authorization
≤1.6.93Update to 1.6.94
- High8.8Unauthorized Account Password Change to Privilege Escalation
≤1.7.16Update to 1.7.17
- Medium4.3Cross-Site Request Forgery
≤1.6.93Update to 1.6.94
- High8.8Cross-Site Request Forgery to User Password Change
≤1.5.6Update to 1.5.7
- Medium6.1Reflected Cross-Site Scripting
<1.4.2Update to 1.4.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
≤1.3.7Update to 1.3.8
- Medium6.5Unauthenticated Remote Plugin Deletion
<1.3.7Update to 1.3.7
OTP Login With Phone Number, OTP Verification: common questions
Does OTP Login With Phone Number, OTP Verification have known vulnerabilities?
Yes. VulnCrest Radar lists 18 known vulnerabilities in OTP Login With Phone Number, OTP Verification: 3 critical, 7 high, 8 medium. None are known to affect version null.
How do I check which version of OTP Login With Phone Number, OTP Verification I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent OTP Login With Phone Number, OTP Verification vulnerability?
CVE-2026-115967, published Oct 27, 2026: OTP Login With Phone Number, OTP Verification <= 1.8.78 - Authenticated (Subscriber+) Account Takeover. Severity: High (CVSS 8.8).
Is any OTP Login With Phone Number, OTP Verification vulnerability listed in CISA KEV?
No. None of the known OTP Login With Phone Number, OTP Verification vulnerabilities is currently listed in the CISA KEV catalog.