High severity · published Dec 6, 2024
CVE-2024-11178
Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the 6-digit numeric OTP that makes it possible to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LW
Login with OTP · india-web-developer
through 1.4.2 · source: vendor
LW
Login With Otp Plugin · Wordpress
through 1.4.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11178
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/otp-login/tags/1.4.2/lib/otpl-class.php#L293
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/otp-login/tags/1.4.2/lib/otpl-class.php#L317
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3216953/otp-login#file18
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/d3775d48-5985-475e-8fb9-c4c5fd044772?source=cve
More from Login with OTP
9.8
CVE-2026-8760
Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force