CVE-2024-9862: CWE-639 Authorization Bypass Through User-Controlled Key in cyberlord92 Miniorange OTP Verification with Firebase
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
AI Analysis
Technical Summary
CVE-2024-9862 is an authorization bypass vulnerability in the Miniorange OTP Verification with Firebase plugin for WordPress, affecting versions up to 3.6.0. The vulnerability is due to the plugin allowing user-controlled access to objects and lacking a current password verification step, which permits unauthenticated attackers to arbitrarily change user passwords. This can lead to full account takeover, including administrator accounts. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A patch is available to fix this critical issue.
Potential Impact
Successful exploitation allows unauthenticated attackers to change any user's password without authorization, potentially leading to full account takeover, including administrator accounts. This compromises confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
A patch is available for this vulnerability. Users of the Miniorange OTP Verification with Firebase plugin should update to the fixed version immediately to prevent exploitation. Since the plugin is not a cloud service, remediation depends on applying the vendor's patch. Check the vendor's official channels for the patch and update instructions.
CVE-2024-9862: CWE-639 Authorization Bypass Through User-Controlled Key in cyberlord92 Miniorange OTP Verification with Firebase
Description
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-9862 is an authorization bypass vulnerability in the Miniorange OTP Verification with Firebase plugin for WordPress, affecting versions up to 3.6.0. The vulnerability is due to the plugin allowing user-controlled access to objects and lacking a current password verification step, which permits unauthenticated attackers to arbitrarily change user passwords. This can lead to full account takeover, including administrator accounts. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A patch is available to fix this critical issue.
Potential Impact
Successful exploitation allows unauthenticated attackers to change any user's password without authorization, potentially leading to full account takeover, including administrator accounts. This compromises confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
A patch is available for this vulnerability. Users of the Miniorange OTP Verification with Firebase plugin should update to the fixed version immediately to prevent exploitation. Since the plugin is not a cloud service, remediation depends on applying the vendor's patch. Check the vendor's official channels for the patch and update instructions.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-11T12:45:59.762Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b61b7ef31ef0b554d4c
Added to database: 2/25/2026, 9:36:33 PM
Last enriched: 4/9/2026, 3:37:34 PM
Last updated: 4/12/2026, 1:41:41 PM
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.