CVE-2026-8760 PUBLISHED

Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force

Assigner: Wordfence
Reserved: 16.05.2026 Published: 27.05.2026 Updated: 27.05.2026

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to otpl_login_action() was placed only inside the OTP-generation branch and is never evaluated on the OTP-validation branch, and the generated 6-digit OTP additionally has no expiration. This makes it possible for unauthenticated attackers to brute-force the 900,000-value OTP space for any user account (including administrators) and obtain a valid wp_set_auth_cookie() session, leading to full site compromise.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor india-web-developer
Product Login with OTP
Versions Default: unaffected
  • Version <= 1.6 is affected

Credits

  • Irwan Kusuma finder

References

Problem Types

  • CWE-307 Improper Restriction of Excessive Authentication Attempts CWE