CVE-2025-9967

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-15

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9967

EUVD

EUVD-2025-34545

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	orion_sms_otp_verification	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

The vulnerability in the Orion SMS OTP Verification plugin for WordPress allows an unauthenticated attacker to escalate privileges by taking over user accounts. This happens because the plugin does not properly verify a user's identity before allowing a password update. If the attacker knows a user's phone number, they can change that user's password to a one-time password, effectively gaining access to the account.

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts by attackers who know the users' phone numbers. It allows attackers to change passwords without authentication, potentially compromising sensitive information, causing data breaches, and disrupting service availability.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Orion SMS OTP Verification plugin for WordPress to a version later than 1.1.7 where the issue is fixed. Additionally, restrict access to password reset functionality and monitor for suspicious password changes, especially those triggered by phone number inputs.

Hi! I’m here to help you understand CVE-2025-9967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70