otp_verification vulnerabilities

2 known vulnerabilities in otp_verification from miniOrange. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Miniorange OTP Verification with Firebase: Incorrect Privilege Assignment

  CVE-2024-9863Oct 17, 2024Cyberlord92

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for un

• 9.8 Critical severity

  Miniorange OTP Verification with Firebase: Authorization Bypass Through User-Controlled Key

  CVE-2024-9862Oct 17, 2024Cyberlord92

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorizati