CVE-2026-15210CWE-287

CVE-2026-15210

Critical · published August 5, 2026

CVSS v3.1

9.1

EPSS

Percentile

35.0

In the wild

Unconfirmed

What it is

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00418 · 35.0th percentile
Weakness: CWE-287 · Improper Authentication
Published: 2026-08-05T11:16Z

References (1)

https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040/ · [email protected]

EPSS history

Timeline

05 AUG 06:00Z
Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
cvelistv5