CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing
Attackers can bypass authentication by brute-forcing OTPs due to missing rate limits, leading to account takeover in the Digits WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4094?
CVE-2025-4094 is a critical authentication bypass vulnerability in Unknown DIGITS: WordPress Mobile Number Signup and Login, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Which versions are affected by CVE-2025-4094?
It affects 1 product.
Products include Unitedover Digits.
How do I fix CVE-2025-4094?
No fix has been published for CVE-2025-4094 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-4094 being exploited?
There is no known exploitation of CVE-2025-4094 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Unknown DIGITS: WordPress Mobile Number Signup and Login
Sources
Also known as GHSA-vr5w-fmp9-m564.