The Login with OTP plugin for WordPress versions up to 1.6 contains an authentication bypass vulnerability. This is due to an incomplete fix for CVE-2024-11178 where rate-limiting checks are only applied to OTP generation, not validation. The 6-digit OTP has no expiration, allowing attackers to brute-force the 900,000-value OTP space. Successful exploitation grants attackers valid authentication cookies for any user account, including administrators, leading to full site compromise.