CVE-2025-4094-POC

WordPress插件Digits OTP绕过 CVE-2025-4094 概述 该脚本是针对WordPress插件Digits（版本 -p -i OPTIONS 参数 -u, --url: 必需 目标URL（例如：https://example.com/wp-admin/admin-ajax.php） -p, --phone: 必需 目标手机号码（仅数字） -i, --instance-id: 必需 从拦截请求中获取的实例ID -d, --digits: 可选 OTP位数（4位或6位，默认为4） -w, --workers: 可选 并行工作线程数（默认为10） --start: 可选...

WordPress Digits plugin < 8.4.6.1 - Auth Bypass via OTP Bruteforcing vulnerability

Auth Bypass via OTP Bruteforcing vulnerability discovered by Saleh Tarawneh in WordPress Plugin Digits versions 8.4.6.1...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

CVE-2025-4094 affects the Digits WordPress plugin: versions prior to 8.4.6.1 do not rate-limit OTP validation attempts, enabling brute-force attacks that can bypass authentication. Public disclosures and PoCs describe OTP brute-forcing across forgot-password and OTP validation endpoints, with exp...

Exploit for CVE-2025-4094

WordPress Plugin Digits OTP Bypass CVE-2025-4094 Overvie...

CVE-2025-4094

creationtimestamp| type| source ---|---|--- 2025-05-15 04:50:18+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/36841 2025-05-15 13:17:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/36884 2025-05-21 22:41:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17207...