ExploitPublished 29 May 2025

WordPress Digits Plugin 8.4.6.1 · Authentication Bypass via OTP Bruteforcing

Source Exploit-DB RSS Feed

Mentioned vulnerabilities

CVE-2025-4094

Severity

Medium

Rated by Threat Radar

Data as of 11 Jun 2025, 08:39 UTC

What to do

AI-suggested

1. Immediate update or patching of the Digits plugin to version 8.4.6.1 or later where the vulnerability is fixed. If an official patch is unavailable, disable the plugin or the OTP feature temporarily. 2. Implement server-side rate limiting on OTP verification endpoints to restrict the number of attempts per user or IP address within a defined time window. 3. Employ account lockout mechanisms after a defined number of failed OTP attempts to prevent brute force attacks. 4. Enhance logging and monitoring to detect unusual OTP verification request patterns indicative of brute force attempts. 5. Use CAPTCHA or other challenge-response tests on OTP submission forms to hinder automated attacks. 6. Consider integrating additional authentication factors beyond OTP, such as hardware tokens or biometric verification. 7. For organizations unable to immediately patch, implement Web Application Firewall (WAF) rules to detect and block rapid sequential OTP verification attempts. 8. Educate users about the risks and encourage strong, unique passwords alongside OTP usage. 9. Regularly audit and review plugin usage and configurations to ensure compliance with security best practices. 10. Coordinate with hosting providers to monitor and mitigate large-scale brute force activities targeting WordPress sites.

Description

WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing

Impact

European organizations using WordPress with the Digits plugin version 8.4.6.1 or earlier are at significant risk of unauthorized access to user accounts, including administrative accounts if OTP-based authentication or password reset is enabled. This can lead to data breaches, unauthorized data modification, and potential lateral movement within affected networks. The compromise of user accounts can also facilitate phishing, fraud, and further exploitation of organizational resources. Given WordPress's widespread use in Europe for websites ranging from small businesses to government portals, the impact can be broad and severe. Organizations handling sensitive user data, financial information, or critical infrastructure are particularly vulnerable. The lack of rate limiting means automated attacks can be conducted at scale, increasing the likelihood of successful exploitation. Additionally, the attack undermines user trust and can cause reputational damage. The exploit's automation capability lowers the skill barrier for attackers, increasing the threat landscape. Without mitigation, attackers can bypass multi-factor authentication protections, severely weakening overall security postures.

Indicators of compromise

Exploit source code

Exploit code for WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing2,880 characters

# Exploit Title: WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing 
# Google Dork: inurl:/wp-content/plugins/digits/
# Date: 2025-04-30
# Exploit Author: Saleh Tarawneh
# Vendor Homepage: https://digits.unitedover.com/
# Version: < 8.4.6.1
# CVE : CVE-2025-4094

"""
The Digits plugin for WordPress prior to version 8.4.6.1 is vulnerable to OTP brute-force attacks due to missing rate limiting.
An attacker can exploit this to bypass authentication or password reset by ite…

References

Community reviews

Loading reviews…