CVE-2025-9967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9967", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-03T23:15:21.262Z", "datePublished": "2025-10-15T08:26:00.449Z", "dateUpdated": "2026-04-08T17:16:09.049Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:09.049Z"}, "affected": [{"vendor": "gsayed786", "product": "Orion SMS OTP Verification.", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number"}], "title": "Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js"}, {"url": "https://plugins.trac.wordpress.org/log/orion-sms-otp-verification/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-14T20:00:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T13:23:42.509544Z", "id": "CVE-2025-9967", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T14:54:19.871Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-15T13:23:42.509544Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T13:23:43.156Z"}}], "cna": {"title": "Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "gsayed786", "product": "Orion SMS OTP Verification", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T20:00:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js"}], "descriptions": [{"lang": "en", "value": "The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-15T08:26:00.449Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9967", "state": "PUBLISHED", "dateUpdated": "2025-10-15T14:54:19.871Z", "dateReserved": "2025-09-03T23:15:21.262Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:26:00.449Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Orion SMS OTP Verification.", "vendor": "gsayed786", "versions": [{"lessThanOrEqual": "1.1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number"}, {"lang": "es", "value": "El plugin Orion SMS OTP Verification para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.1.7, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar su contrase\u00f1a. Esto hace posible que atacantes no autenticados cambien la contrase\u00f1a de cualquier usuario a una contrase\u00f1a de un solo uso si el atacante conoce el n\u00famero de tel\u00e9fono del usuario."}], "id": "CVE-2025-9967", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9967", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T13:23:42.509544Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:43.500", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/orion-sms-otp-verification/trunk/vendor/js/reset-password.js"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/log/orion-sms-otp-verification/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:39:55.696070+00:00", "value": {"mitigation_remediation": ["Upgrade the Orion SMS OTP Verification plugin to the latest available version that contains the fix for the privilege\u2011escalation flaw.", "Disable or restrict access to the reset-password.js endpoint so that unauthenticated requests cannot trigger a password change; this can be done via web\u2011server rules or by removing the file from the installation if the functionality is not needed.", "Add an additional layer of verification for password changes, such as requiring the current password or a multi\u2011factor confirmation before allowing the reset, to prevent unauthorized account takeover."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Account Takeover"}, "threat_synthesis": {"affected_systems": "All installations of the Orion SMS OTP Verification plugin version 1.1.7 and earlier are affected. No other vendors or products are listed. Any WordPress site that relies on these plugin versions for phone\u2011based authentication is at risk.", "description_and_impact": "The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation because it does not verify that a request to reset a password is authorized, and it is identified as a CWE-288 authentication bypass flaw. Unauthenticated users who know a target\u2019s phone number can invoke the plugin\u2019s reset-password endpoint and set that user\u2019s password to a one\u2011time\u2011password value, effectively taking over the account. This grants full access to any content or admin functions tied to the compromised user, enabling further exploitation.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity, the EPSS score of < 1% suggests a very low but non\u2011zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the plugin\u2019s logic bypasses authentication entirely and only requires knowledge of a phone number, the exploit path is simple and could be executed by an unauthenticated attacker with minimal information. The ability to assume any user account presents a high risk to site integrity and confidentiality."}}}}, "created": "2025-10-21T09:41:13.451931+00:00", "updated": "2026-04-20T21:45:18.969914+00:00", "vendors": ["gsayed786", "gsayed786$PRODUCT$orion_sms_otp_verification", "wordpress", "wordpress$PRODUCT$wordpress"]}