CVE-2025-9967: Orion SMS OTP Verification WordPress Plugin: Authentication Bypass via Password Reset
The Orion SMS OTP Verification plugin for WordPress, in all versions up to and including 1.1.7, does not properly verify a user's identity before updating their password. Wordfence reports a CVSS 3.1 base score of 9.8 (critical), and the record describes possible account takeover without authentication when the attacker knows the victim's phone number. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
The Orion SMS OTP Verification plugin for WordPress has a weakness in its password update flow. According to the Wordfence record, the plugin does not properly validate a user's identity before changing the account password. The record classifies the issue as CWE-288, Authentication Bypass Using an Alternate Path or Channel.
Impact
- The record describes privilege escalation through account takeover.
- Per the description, an unauthenticated attacker who knows a target user's phone number could change that user's password to a one-time password.
- Wordfence reports a CVSS 3.1 base score of 9.8 (critical), with a vector indicating network reach, low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Product: Orion SMS OTP Verification plugin for WordPress.
- Affected versions: all versions up to and including 1.1.7, as stated in the description.
- Fixed versions: none are listed in the record. This does not mean no fix exists. Check the plugin changelog and the Wordfence entry for current status.
Exploitation status
The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Identify every WordPress site that uses the plugin and record the installed version.
- Update to a release newer than 1.1.7 if the vendor has published one, and confirm the fix in the plugin changelog.
- If no fixed release is confirmed, consider deactivating the plugin until a fix is available, and replace phone-based one-time password recovery with a safer method if needed.
- Restrict who can reach password reset functions where the site design allows it, and enforce strong account recovery controls.
Detection guidance
- Review account logs for password changes that the account owner did not request, especially for administrator and editor accounts.
- Watch for sign-ins shortly after password changes, particularly from unfamiliar locations or devices.
- Alert on spikes in password reset activity against many accounts.
Limitations of the available information
- The record has no structured list of affected or fixed versions, so the only version boundary is the description's 1.1.7.
- The record does not include vendor advisory text, patch details or timeline information.
- The status of the record is shown as Deferred, and its scoring and dates should be checked against the current NVD and CVE.org entries.
Frequently asked questions
Which versions of the Orion SMS OTP Verification plugin are affected?
The description states that all versions up to and including 1.1.7 are affected. The record does not provide a structured version list.
Is a fixed version available?
The record lists no fixed version. This does not mean no fix exists, so check the plugin changelog and vendor sources for a release newer than 1.1.7.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.