CVE-2024-9861

The Miniorange OTP Verification with Firebase plugin fails to validate the token supplied during OTP login, so an unauthenticated attacker can log in as any existing user — including an administrator — provided they know the phone number tied to that account. The mechanism that's supposed to prove possession of a phone is effectively skipped, collapsing OTP login into 'name the phone number, get the account.'

Two things shape the real risk. On one hand, this is unauthenticated admin takeover on a WordPress plugin, which is severe; on the other, it's gated by knowing the target's phone number and rated as a difficult attack, so it's not a blind one-request smash against every install. That makes it most dangerous for accounts whose associated phone numbers are discoverable or guessable, and it leans toward targeted use over indiscriminate spraying.

We handle this with the usual WordPress inventory sweep, sharpened by the phone-number precondition. We map which sites run this plugin and at what version, and prioritize by whether high-value accounts' phone numbers are exposed anywhere an attacker could harvest them. Where we can't patch immediately, watching for anomalous OTP-login attempts against privileged accounts is a sensible interim detection, but the fix is getting affected sites past the vulnerable version quickly given that admin impersonation is the prize.