The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for C…

The Login with OTP plugin for WordPress versions up to 1.6 contains an authentication bypass vulnerability. This is due to an incomplete fix for CVE-2024-11178 where rate-limiting checks are only applied to OTP generation, not validation. The 6-digit OTP has no expiration, allowing attackers to brute-force the 900,000-value OTP space. Successful exploitation grants attackers valid authentication cookies for any user account, including administrators, leading to full site compromise.