PT-2025-22323 · WordPress · Digits: Wordpress Mobile Number Signup/Login

Saleh Tarawneh · Published 2025-05-21 · Updated 2025-05-26 · CVE-2025-4094

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin versions prior to 8.4.6.1

Description The issue concerns the lack of rate limiting for OTP validation attempts, making it possible for attackers to brute force them.

Recommendations For versions prior to 8.4.6.1, update to version 8.4.6.1 or later to resolve the issue. As a temporary workaround, consider implementing custom rate limiting for OTP validation attempts until the official update can be applied. Restrict access to the OTP validation endpoint to minimize the risk of exploitation. Avoid using the OTP validation feature in the affected plugin until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2025-4094

Affected Products

Digits: Wordpress Mobile Number Signup/Login

References · 6

• 🔥 https://exploit-db.com/exploits/52307 · Exploit
• 🔥 https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4094 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4094 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925074693524238344 · Twitter Post
• https://twitter.com/cracbot/status/1926956518223544492 · Twitter Post