CVE-2025-9967 is a critical authentication bypass vulnerability (CWE-288) in the Orion SMS OTP Verification plugin for WordPress, affecting all versions up to and including 1.1.7. The vulnerability allows unauthenticated attackers to change any user's password to a one-time password if the attacker knows the user's phone number. This occurs because the plugin fails to properly validate the user's identity before allowing password updates, enabling privilege escalation and account takeover. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation guidance is currently provided by the vendor.

Successful exploitation allows unauthenticated attackers to reset arbitrary users' passwords, leading to full account takeover. This compromises user confidentiality, integrity of user accounts, and availability of the affected accounts. The vulnerability poses a critical risk to any WordPress site using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or uninstalling the Orion SMS OTP Verification plugin to prevent exploitation. Monitor for vendor updates and apply official patches promptly once released.