CVE-2026-15210

Name of the Vulnerable Software and Affected Versions OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71

Description An issue exists where the plugin fails to limit the number of OTP verification attempts and does not invalidate a one-time login code after an incorrect guess. An unauthenticated user can request a login code for any account. Since the code is a short numeric OTP (One-Time Password), an attacker can brute-force it to gain unauthorized access to any account, including those with administrator privileges.

Recommendations Update the plugin to version 1.8.71 or later.