CVE-2026-8760

Vulnerability

The Login with OTP plugin for WordPress up to version 1.6 fails to enforce rate-limiting or lockout on the OTP validation branch. An earlier attempt to fix CVE-2024-11178 [1] added a check only to otpl_login_action() during OTP generation, but not during actual OTP validation. The generated 6-digit numeric OTP also lacks an expiration time, leaving the entire 900,000-value space (000000–999999) perpetually valid. Affected versions: all up to and including 1.6 [CVE description].

Exploitation

An unauthenticated attacker needs network access to the WordPress login endpoint and knowledge of a target username (e.g., an administrator email). Because no lockout or rate-limit exists on the OTP validation URL, the attacker can script repeated submissions of random 6-digit OTPs. The volume of requests required is bounded by the OTP space size, and no per-IP or per-user throttling is applied. The attack is feasible in minutes or hours depending on network speed [CVE description].

Impact

Successful brute-force of a valid OTP yields a valid wp_set_auth_cookie() session for that user, granting unauthenticated full-site access. Privilege escalation is immediate if the compromised account is an administrator, leading to complete site compromise including data theft, modification, and potential server-level control [CVE description] [1].

Mitigation

As of the publication date (2026-05-27), no patched version has been announced. The vendor must release a version beyond 1.6 that implements rate-limiting/lockout on the validation branch and sets an OTP expiration (e.g., 5–10 minutes). Until then, site administrators should temporarily disable the plugin or implement external web application firewall (WAF) rules to block rapid OTP requests. The CVE is not yet listed in CISA KEV [CVE description] [1].