Critical · published December 5, 2025
🚨 A simple empty OTP submission can let attackers log in as any user — even administrators! 🔥 You read that right! Think of it like a restaurant where the waiter accepts any order without checking if the customer actually placed it. If you stroll in and say, 'I’d like a steak, please,' you might just get served without a reservation! This vulnerability is absolutely devastating, as it allows anyone to exploit this flaw and gain unauthorized access to sensitive user accounts. Imagine an attacker walking into your admin panel, able to bypass authentication entirely and wreak havoc on your website! Users could find their data compromised, and the entire site could be at risk.
Think of it like a restaurant where the waiter accepts any order without checking if the customer actually placed it. If you stroll in and say, 'I’d like a steak, please,' you might just get served without a reservation! The plugin fails to properly validate that a One-Time Password (OTP) was generated before comparing it to user input in the 'user_verification_form_wrap_process_otpLogin' function. This allows unauthenticated users to log in using an empty OTP, bypassing authentication checks.
This vulnerability is absolutely devastating, as it allows anyone to exploit this flaw and gain unauthorized access to sensitive user accounts. Imagine an attacker walking into your admin panel, able to bypass authentication entirely and wreak havoc on your website! Users could find their data compromised, and the entire site could be at risk. Patch this vulnerability immediately by updating the plugin to version 2.0.45 or later. Ensure that proper OTP validation is implemented to prevent such bypasses. Review your user access logs for any suspicious activities post-update. You've got this! With these steps, you can secure your site and keep those unauthorized logins at bay! 🛡️