The OTP Login With Phone Number, OTP Verification WordPress plugin versions before 1.8.71 contains a critical security flaw. The plugin fails to limit the number of OTP verification attempts and does not invalidate a one-time login code after an incorrect guess. Any unauthenticated user can request a login code for any account on the system. Since the OTP is a short numeric code, attackers can brute-force it with relative ease. Successful exploitation allows complete account takeover, including administrator accounts. This vulnerability poses a severe risk to WordPress sites using this plugin. No authentication is required to exploit this vulnerability, making it highly accessible to attackers.