CVE-2025-4094
📋 TL;DR
The DIGITS WordPress plugin before version 8.4.6.1 lacks rate limiting on OTP validation attempts, allowing attackers to brute-force one-time passwords and potentially gain unauthorized access. This affects all WordPress sites using vulnerable versions of the DIGITS plugin for mobile number signup and login functionality.
💻 Affected Systems
- DIGITS: WordPress Mobile Number Signup and Login
📦 What is this software?
Digits by Unitedover
⚠️ Risk & Real-World Impact
Worst Case
Attackers brute-force OTPs to gain administrative access, leading to complete site compromise, data theft, malware injection, or defacement.
Likely Case
Attackers gain unauthorized user accounts, potentially escalating privileges or accessing sensitive user data.
If Mitigated
With rate limiting or other controls, attackers cannot brute-force OTPs, maintaining normal authentication security.
🎯 Exploit Status
Brute-force attacks are simple to automate; no authentication required to attempt OTP validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.6.1
Vendor Advisory: https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find DIGITS plugin and click 'Update Now'. 4. Verify update to version 8.4.6.1 or later.
🔧 Temporary Workarounds
Implement Web Application Firewall (WAF)
allConfigure WAF rules to rate limit OTP validation requests per IP address.
Disable DIGITS Plugin
linuxTemporarily disable the plugin until patched, if mobile number login is not critical.
wp plugin deactivate digits
🧯 If You Can't Patch
- Disable the DIGITS plugin entirely to eliminate the vulnerability.
- Implement network-level rate limiting or IP blocking for excessive OTP attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel under Plugins > Installed Plugins for DIGITS version below 8.4.6.1.Check Version:
wp plugin get digits --field=versionVerify Fix Applied:
Confirm DIGITS plugin version is 8.4.6.1 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Multiple failed OTP validation attempts from single IP address in WordPress or web server logs.
Network Indicators:
- High volume of POST requests to OTP validation endpoints (e.g., /wp-json/digits/v1/validate_otp).
SIEM Query:
source="wordpress.log" AND "validate_otp" AND status=401 | stats count by src_ip | where count > 10