Critical · published October 15, 2025
🚨 An unauthenticated attacker can change any user's password in the Orion SMS OTP Verification plugin, all because the plugin forgets to check who’s asking! 🔥 Think of it like a restaurant that serves food to anyone who simply claims to know your table number — they can just walk in and enjoy your meal without any verification! This vulnerability allows attackers to easily seize control of user accounts, leaving victims locked out of their accounts or worse, with their sensitive information exposed. With just a phone number, an attacker can bypass security and take over accounts, leading to potentially devastating consequences for both users and website owners.
Think of it like a restaurant that serves food to anyone who simply claims to know your table number — they can just walk in and enjoy your meal without any verification! The Orion SMS OTP Verification plugin for WordPress lacks proper validation of a user's identity when changing passwords, which allows unauthorized users to reset any account's password if they know the user's phone number. This leaves the door wide open for malicious actors!
This vulnerability allows attackers to easily seize control of user accounts, leaving victims locked out of their accounts or worse, with their sensitive information exposed. With just a phone number, an attacker can bypass security and take over accounts, leading to potentially devastating consequences for both users and website owners. Update the Orion SMS OTP Verification plugin to the latest version immediately to mitigate this issue. Additionally, review your user authentication processes to ensure that identity verification is robust and secure. You've got this! Take action now to secure your site and protect your users! 🛡️