PT-2025-42314 · WordPress · Orion Sms Otp Verification

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-9967

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orion SMS OTP Verification plugin for WordPress versions through 1.1.7

Description The Orion SMS OTP Verification plugin for WordPress is susceptible to privilege escalation, leading to potential account takeover. The issue stems from insufficient user identity validation before password updates, allowing unauthenticated attackers to modify user passwords. If an attacker knows a user's phone number, they can change the user's password to a one-time password. There is no mention of the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerable process involves updating a user's password without proper authentication.

Recommendations Update the Orion SMS OTP Verification plugin to version 1.1.8 or later. As a temporary measure, disable the Orion SMS OTP Verification plugin to protect your site.

Fix

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-9967

Affected Products

Orion Sms Otp Verification

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-9967 · Security Note
• https://twitter.com/ZeroPathLabs/status/1978403333002977439 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve · Note
• https://plugins.trac.wordpress.org/log/orion-sms-otp-verification · Note
• https://twitter.com/CveFindCom/status/1978380130989879603 · Twitter Post
• https://t.me/CVEtracker/34991 · Telegram Post
• https://twitter.com/CVEnew/status/1978545113115824459 · Twitter Post
• https://twitter.com/offseq/status/1978401458828558472 · Twitter Post
• https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js · Note