CVE-2025-4094

This PoC exploits an OTP brute-force vulnerability in the WordPress Digits Plugin (CVE-2025-4094) due to missing rate limiting. It automates brute-forcing 4-digit OTPs (or 6-digit) in the 'Forgot Password' flow to bypass authentication.

This is a functional proof-of-concept exploit for CVE-2025-4094, targeting an OTP authentication bypass in the WordPress Digits plugin (versions < 8.4.6.1). The script uses a brute-force approach with parallel requests to bypass OTP verification.

This repository contains a functional PoC for CVE-2025-4094, an OTP brute-force vulnerability in the WordPress Digits plugin. The exploit automates brute-forcing OTP codes due to missing rate limiting, allowing authentication bypass.