The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Miniorange Firebase Sms Otp Verification Plugin | — | Update miniorange-firebase-sms-otp-verification plugin to version 3.6.1, or a newer patched version | May 15, 2025 | Oct 16, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub