VYPR
← All advisories
Unrated severityNVD Advisory· Published May 21, 2025· Updated Aug 27, 2025

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

CVE-2025-4094

Description

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

Affected products

2
  • WordPress/Mobile Number Signup and Login WordPress plugindescription
  • DIGITS/DIGITSllm-create
    Range: <8.4.6.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.