Executive Summary

The vulnerability in the Orion SMS OTP Verification plugin for WordPress allows an unauthenticated attacker to escalate privileges by taking over user accounts. This happens because the plugin does not properly verify a user's identity before allowing a password update. If the attacker knows a user's phone number, they can change that user's password to a one-time password, effectively gaining access to the account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts by attackers who know the users' phone numbers. It allows attackers to change passwords without authentication, potentially compromising sensitive information, causing data breaches, and disrupting service availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Orion SMS OTP Verification plugin for WordPress to a version later than 1.1.7 where the issue is fixed. Additionally, restrict access to password reset functionality and monitor for suspicious password changes, especially those triggered by phone number inputs.

Useful 0 Not Useful 0