CVE-2023-2706

Name of the Vulnerable Software and Affected Versions OTP Login Woocommerce & Gravity Forms plugin for WordPress (affected versions not specified)

Description The OTP Login Woocommerce & Gravity Forms plugin for WordPress has an issue that allows authentication bypass. This happens because the plugin returns OTP codes in an AJAX response when generating them for user login via phone number. As a result, unauthenticated attackers can obtain login codes for administrators if they have access to the configured phone number, which can be obtained through social engineering or reconnaissance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.