OTP Login With Phone Number, OTP Verification vulnerabilities
6 known vulnerabilities in OTP Login With Phone Number, OTP Verification from Glboy. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
OTP Login With Phone Number, OTP Verification: Improper Authentication
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase sess
- 8.1 High severity
OTP Login With Phone Number, OTP Verification: Missing Authorization
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it pos
- 8.8 High severity
OTP Login With Phone Number, OTP Verification: Improper Privilege Management
The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' func
- 8.1 High severity
OTP Login With Phone Number, OTP Verification: Weak Password Recovery Mechanism for Forgotten Password
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time l
- 9.8 Critical severity
OTP Login With Phone Number, OTP Verification: Authentication Bypass Using an Alternate Path or Channel
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' functio
- 8.8 High severity
OTP Login With Phone Number, OTP Verification: Cross-Site Request Forgery
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticat