WordPress OTP Plugin Authentication Bypass via Brute Force

The Login with OTP plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to 1.6. An incomplete patch for a previous vulnerability left the rate-limiting and lockout mechanisms only partially implemented—they protect the OTP generation process but fail to guard the OTP validation step. Combined with the absence of OTP expiration timers, attackers can systematically brute-force through the 900,000 possible 6-digit codes without facing account lockouts or throttling delays. This vulnerability directly enables unauthorized account access on any WordPress site using this plugin, potentially exposing admin accounts, user data, and site integrity to unauthenticated threat actors.

Casky's AI-driven detection framework would identify attack patterns associated with this vulnerability through behavioral analysis across multiple security skill domains. Practitioners would observe findings related to credential compromise attempts and access control failures—detecting unusual volumes of failed authentication requests from single or distributed sources, successful logins following failed OTP submissions, and absence of expected rate-limiting responses that should block rapid validation attempts. While traditional MITRE ATT&CK mapping shows no direct technique codes for this specific flaw, Casky's extended reasoning would correlate indicators with T1078 (Valid Accounts) and T1110 (Brute Force) patterns, surfacing anomalous authentication sequences that reveal exploitation attempts even when the underlying code-level vulnerability cannot be directly observed in logs.