The vulnerability in the 'OTP Login With Phone Number, OTP Verification' WordPress plugin arises from a weak password recovery mechanism (CWE-640). The plugin generates a 6-digit numeric reset code that is too weak to resist guessing attacks. Additionally, there are no restrictions on the number of attempts or time limits for using the reset code, enabling unauthenticated attackers to reset passwords of arbitrary users by brute forcing the reset code. This affects all versions up to and including 1.7.34. The CVSS 3.1 score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to reset the password of any user, leading to full account takeover. This compromises user confidentiality, integrity, and availability of affected accounts. The vulnerability can severely impact the security of WordPress sites using this plugin, potentially allowing attackers to gain unauthorized access and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to password reset functionality. Monitoring for suspicious password reset activity is advised. Avoid relying solely on this plugin for authentication until the vulnerability is addressed.