CVE-2025-4094

Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

Affected

DIGITS: WordPress Mobile Number Signup and Login

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

16.43% chance of exploitation in the next 30 days, 97th percentile

Published

2025-05-21

Updated

2025-08-27

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/
• POCPioneer/CVE-2025-4094-POC2★ · 2025-05-16
• starawneh/CVE-2025-40941★ · 2025-05-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52307

Security advisories

• https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb

References

• CVE Record
• NVD entry