What is GHSA-gfjg-jw2h-6xcq?

GHSA-gfjg-jw2h-6xcq is a security advisory published by GitHub Security Advisories with Critical severity. The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit...

Which CVE IDs does GHSA-gfjg-jw2h-6xcq cover?

GHSA-gfjg-jw2h-6xcq covers the following CVE IDs: CVE-2026-15210. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gfjg-jw2h-6xcq?

GHSA-gfjg-jw2h-6xcq has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-gfjg-jw2h-6xcqCriticalCVSS 9.1

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-15210 →

📋 Description

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15210
https://wpscan.com/vulnerability/96101127-8b13-4770-9204-f540fb044040
https://github.com/advisories/GHSA-gfjg-jw2h-6xcq