CVE-2026-15210 Overview
CVE-2026-15210 affects the OTP Login With Phone Number, OTP Verification WordPress plugin in versions before 1.8.71. The plugin does not limit OTP verification attempts and does not invalidate one-time login codes after a wrong guess. An unauthenticated attacker can request a login code for any account, including administrator accounts. Because the code is a short numeric OTP, an attacker can brute-force valid values and take over the target account. The weakness is classified under CWE-287: Improper Authentication.
Critical Impact
Unauthenticated attackers can brute-force numeric OTPs to hijack any WordPress account, including administrators, leading to full site compromise.
Affected Products
- OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71
- WordPress sites using phone-based OTP authentication provided by this plugin
- Administrator, editor, and subscriber accounts registered on affected installations
Discovery Timeline
- 2026-08-05 - CVE-2026-15210 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15210
Vulnerability Analysis
The plugin implements a phone-number login flow that issues a numeric one-time password (OTP) to authenticate users. Two design defects combine to break the authentication guarantee. First, the plugin does not rate-limit OTP verification attempts. Second, it does not invalidate the issued OTP after an incorrect submission. An attacker can request an OTP for any known username or phone number without authentication, then submit verification requests iteratively until the correct value is found.
Because the OTP is a short numeric string, the keyspace is small enough to exhaust with automated requests. Successful brute force returns a valid authenticated session for the targeted account. When the target is an administrator, the attacker gains full control of the WordPress site, including plugin installation, arbitrary file writes through theme editing, and database access.
Root Cause
The root cause is missing enforcement of authentication attempt limits and missing single-use semantics on the OTP verification endpoint. The plugin trusts that a short numeric secret is sufficient without binding it to attempt counters, exponential backoff, or invalidation on failure. This maps directly to CWE-287: Improper Authentication.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker enumerates or guesses a target username or phone number, triggers the OTP request endpoint, then repeatedly submits verification requests with varying numeric codes. Since failed attempts do not invalidate the code and no lockout exists, the attacker continues until authentication succeeds. See the WPScan Vulnerability Report for additional context.
Detection Methods for CVE-2026-15210
Indicators of Compromise
- High volumes of POST requests to the plugin's OTP verification endpoint from a single source IP or a small set of IPs
- Repeated OTP request events targeting the same username or phone number in short time windows
- Successful administrator logins immediately following bursts of failed OTP verification attempts
- New administrator accounts, plugin installations, or theme file modifications shortly after suspicious login activity
Detection Strategies
- Parse WordPress access logs for repeated hits to OTP verification URLs and correlate with authentication success events
- Alert on any account, especially administrators, that receives more than a small threshold of OTP verification requests within minutes
- Monitor wp_users and wp_usermeta tables for unexpected role changes or session token creation
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized analytics platform for correlation and long-term retention
- Track outbound SMS or messaging provider volume for anomalous OTP issuance patterns
- Alert on administrative actions such as plugin installation, user creation, or file editor use following login events tied to the OTP flow
How to Mitigate CVE-2026-15210
Immediate Actions Required
- Update the OTP Login With Phone Number, OTP Verification plugin to version 1.8.71 or later on all WordPress installations
- Force a password and session reset for all administrator and privileged accounts on affected sites
- Review recent administrator logins, new user accounts, and file modifications for signs of compromise
- Restrict access to /wp-login.php and plugin OTP endpoints using a web application firewall or IP allowlist
Patch Information
The vendor addressed the issue in version 1.8.71 of the plugin. Site operators should upgrade through the WordPress plugin manager or by replacing the plugin files manually. Details are documented in the WPScan Vulnerability Report.
Workarounds
- Disable and remove the plugin until the patched version can be installed
- Deploy a WAF rule that limits requests to the OTP verification endpoint to a small number per source IP per minute
- Enforce multi-factor authentication using a separate, independently maintained plugin for administrator accounts
- Temporarily disable phone-based login and require standard username and password authentication
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
