critical9.8Public exploit code
CVE-2025-4094
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing2025-05-29 · webapps · multiple
Impact
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unitedover | Digits | before 8.4.6.1 |