PT-2025-38531 · WordPress · Miniorange Otp Verification With Firebase

Kenneth Dunn · Published 2025-09-19 · Updated 2025-09-19 · CVE-2025-7665

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Miniorange OTP Verification with Firebase plugin for WordPress versions 3.1.0 through 3.6.2

Description The Miniorange OTP Verification with Firebase plugin for WordPress is susceptible to privilege escalation. A missing capability check on the handle mofirebase form options function allows unauthenticated attackers to update the default role to Administrator. Exploitation requires premium features to be enabled.

Recommendations Update to a version beyond 3.6.2.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-7665

Affected Products

Miniorange Otp Verification With Firebase

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-7665 · Security Note
• https://t.me/cveNotify/135940 · Telegram Post
• https://t.me/CVEtracker/32933 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a9a02910-5674-4266-ab6e-7926bf6adecc?source=cve · Note
• https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/trunk/handler/forms/class-registrationform.php · Note
• https://twitter.com/CVEnew/status/1969110900402766127 · Twitter Post