The WordPress Digits Plugin version 8.4.6.1 and earlier contains a critical vulnerability that allows an attacker to bypass authentication mechanisms by brute forcing the One-Time Password (OTP) used in login or password reset flows. This vulnerability arises due to the absence of rate limiting on OTP verification attempts, enabling an attacker to systematically try all possible OTP combinations (e.g., 4-digit or 6-digit codes) until the correct one is found. The exploit targets the "Forgot Password" flow but can also be applied to the registration process. The vulnerability is classified under CWE-287 (Improper Authentication) and is associated with broken authentication issues as per OWASP Top 10 (A2). The provided proof-of-concept exploit is implemented in Python and automates the brute force attack by sending HTTP POST requests to the vulnerable WordPress endpoint with varying OTP values. The script monitors responses for a success indicator to identify the correct OTP, thereby allowing unauthorized access or password reset without valid credentials. The vulnerability has been assigned CVE-2025-4094 and carries a CVSS v3.1 score of 9.8 (critical) according to the exploit author, although no official CVSS score is provided in the source data. The exploit requires no user interaction beyond intercepting a legitimate OTP verification request and does not require prior authentication, making it highly exploitable. The attack can compromise confidentiality and integrity by allowing unauthorized account access and potential account takeover, and it impacts availability by undermining the authentication mechanism's reliability.

European organizations using WordPress with the Digits plugin version 8.4.6.1 or earlier are at significant risk of unauthorized access to user accounts, including administrative accounts if OTP-based authentication or password reset is enabled. This can lead to data breaches, unauthorized data modification, and potential lateral movement within affected networks. The compromise of user accounts can also facilitate phishing, fraud, and further exploitation of organizational resources. Given WordPress's widespread use in Europe for websites ranging from small businesses to government portals, the impact can be broad and severe. Organizations handling sensitive user data, financial information, or critical infrastructure are particularly vulnerable. The lack of rate limiting means automated attacks can be conducted at scale, increasing the likelihood of successful exploitation. Additionally, the attack undermines user trust and can cause reputational damage. The exploit's automation capability lowers the skill barrier for attackers, increasing the threat landscape. Without mitigation, attackers can bypass multi-factor authentication protections, severely weakening overall security postures.

1. Immediate update or patching of the Digits plugin to version 8.4.6.1 or later where the vulnerability is fixed. If an official patch is unavailable, disable the plugin or the OTP feature temporarily. 2. Implement server-side rate limiting on OTP verification endpoints to restrict the number of attempts per user or IP address within a defined time window. 3. Employ account lockout mechanisms after a defined number of failed OTP attempts to prevent brute force attacks. 4. Enhance logging and monitoring to detect unusual OTP verification request patterns indicative of brute force attempts. 5. Use CAPTCHA or other challenge-response tests on OTP submission forms to hinder automated attacks. 6. Consider integrating additional authentication factors beyond OTP, such as hardware tokens or biometric verification. 7. For organizations unable to immediately patch, implement Web Application Firewall (WAF) rules to detect and block rapid sequential OTP verification attempts. 8. Educate users about the risks and encourage strong, unique passwords alongside OTP usage. 9. Regularly audit and review plugin usage and configurations to ensure compliance with security best practices. 10. Coordinate with hosting providers to monitor and mitigate large-scale brute force activities targeting WordPress sites.