CVE-2025-4094-POC

WordPress 플러그인 Digits OTP 우회 CVE-2025-4094 개요 이 스크립트는 WordPress 플러그인 Digits버전 -p -i OPTIONS 인수 -u, --url: 필수 대상 URL예: https://example.com/wp-admin/admin-ajax.php -p, --phone: 필수 대상 전화번호숫자만 -i, --instance-id: 필수 가로챈 요청의 인스턴스 ID -d, --digits: 선택 OTP 길이4 또는 6자리, 기본값은 4 -w, --workers: 선택 병렬 작업자 수기본값은...

WordPress Digits plugin < 8.4.6.1 - Auth Bypass via OTP Bruteforcing vulnerability

Auth Bypass via OTP Bruteforcing vulnerability discovered by Saleh Tarawneh in WordPress Plugin Digits versions 8.4.6.1...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login plugin (versions before 8.4.6.1 ) is vulnerable to an authentication bypass because it fails to implement rate limiting on OTP validation attempts. This flaw allows unauthenticated attackers to perform bruteforce attacks to guess SMS OTP values...

Exploit for CVE-2025-4094

WordPress Plugin Digits OTP Bypass CVE-2025-4094 Overvie...

CVE-2025-4094

creationtimestamp| type| source ---|---|--- 2025-05-15 04:50:18+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/36841 2025-05-15 13:17:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/36884 2025-05-21 22:41:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17207...