Vulnerability Description
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Miniorange | Otp Verification With Firebase | < 3.6.1 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verificatProduct
- https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verificatProduct
- https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otpPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/04045ec3-dd8e-4ac5-bd7Third Party Advisory
FAQ
What is CVE-2024-9861?
CVE-2024-9861 is a vulnerability with a CVSS score of 8.1 (HIGH). The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being ...
How severe is CVE-2024-9861?
CVE-2024-9861 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-9861?
Check the references section above for vendor advisories and patch information. Affected products include: Miniorange Otp Verification With Firebase.