CVE-2025-9967
CRITICALOrion SMS OTP Verification <1.1.7 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-9967. PoCs published by jFriedli.
AI-analyzed exploit summary This repository contains a functional JavaScript exploit for CVE-2025-9967, demonstrating an unauthenticated OTP password reset vulnerability in WordPress. The PoC extracts a nonce and AJAX URL from the target site, then sends a crafted request to reset a victim's password via OTP, revealing the new password in the response.
Description
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
Exploits (1)
This repository contains a functional JavaScript exploit for CVE-2025-9967, demonstrating an unauthenticated OTP password reset vulnerability in WordPress. The PoC extracts a nonce and AJAX URL from the target site, then sends a crafted request to reset a victim's password via OTP, revealing the new password in the response.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H