CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-4094

CVE-2025-4094 affects the Digits WordPress plugin: versions prior to 8.4.6.1 do not rate-limit OTP validation attempts, enabling brute-force attacks that can bypass authentication. Public disclosures and PoCs describe OTP brute-forcing across forgot-password and OTP validation endpoints, with exp...