CVE-2025-4094

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

15.78% chance of exploitation in the next 30 days, 97th percentile

Published

2025-05-21

Updated

2025-08-27

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/
• POCPioneer/CVE-2025-4094-POC2★ · 2025-05-16
• starawneh/CVE-2025-40941★ · 2025-05-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52307

References

• CVE Record
• NVD entry

Related

• CVE-2025-40909
• CVE-2025-41067
• CVE-2025-40907
• CVE-2025-41068
• CVE-2025-40843
• CVE-2025-41069