Login with OTP vulnerabilities

2 known vulnerabilities in Login with OTP from India-web-developer. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Login with OTP: Improper Restriction of Excessive Authentication Attempts

  CVE-2026-8760May 27, 2026India-web-developerEPSS 1.03%

  The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside th

• 8.1 High severity

  Login with OTP: Authentication Bypass Using an Alternate Path or Channel

  CVE-2024-11178Dec 6, 2024India-web-developer

  The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attacker