CVE-2026-15210 describes an improper authentication vulnerability (CWE-287) in the OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71. The plugin fails to limit OTP verification attempts and does not invalidate OTP codes after failed attempts. An unauthenticated attacker can request OTP codes for arbitrary accounts and brute-force the short numeric OTP to gain unauthorized access, including administrative accounts. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls by brute-forcing OTP codes, leading to full account takeover including administrator accounts. This compromises confidentiality and integrity of the affected WordPress site without impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OTP verification endpoint if possible and monitor for suspicious OTP request activity. Implement rate limiting or other controls to mitigate brute-force attempts if feasible.