Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force
critical
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside the OTP-generation branch and is never evaluated on the OTP-va...
- CVSS:
- 9.8
- Affected:
- up to 1.6
- Fix:
- No patched version reported
- Disclosed:
- May 26, 2026
CVE-2026-8760 on NVD →
Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP
high
The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the 6-digit numeric OTP that m...
- CVSS:
- 8.1
- Affected:
- up to 1.4.2
- Fixed in:
- 1.5
- Disclosed:
- Dec 5, 2024
CVE-2024-11178 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database