CVE-2024-9861

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.

• CWE-288
• CWE-306

• https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L144Product
• https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L190Product
• https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/04045ec3-dd8e-4ac5-bd73-eef6205ecc62?source=cveThird Party Advisory

Published

Oct 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9853The ID-SK Toolkit plugin for WordPress is vulnerable to Stor…6.4
• CVE-2024-9855A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…7.2
• CVE-2024-9856A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCR…4.8
• CVE-2024-9858There exists an insecure default user permission in Google C…7.8
• CVE-2024-9859Type confusion in WebAssembly in Google Chrome prior to 126.…8.8
• CVE-2024-9860The Bridge Core plugin for WordPress is vulnerable to unauth…5.4
• CVE-2024-9862The Miniorange OTP Verification with Firebase plugin for Wor…9.8
• CVE-2024-9863The Miniorange OTP Verification with Firebase plugin for Wor…9.8
• CVE-2024-9864The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1
• CVE-2024-9865The EventPrime – Events Calendar, Bookings and Tickets plugi…6.1
• CVE-2024-9866The Event Tickets with Ticket Scanner plugin for WordPress i…5.4
• CVE-2024-9867The Element Pack Elementor Addons (Header Footer, Template L…5.4