CVE-2024-9863criticalCWE-266

CVE-2024-9863: critical vulnerability in cyberlord92 Miniorange OTP Verification with…

Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value

Published · Updated

Follow this CVE+ Monitor Miniorange OTP Verification with Firebase

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.6%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cyberlord92 · Miniorange OTP Verification with Firebase
Related CVEs — cyberlord92 Miniorange OTP Verification with…

In the same product, most dangerous first.

CVE-2024-9861HIGHMiniorange OTP Verification with Firebase <= 3.6.0 - Authentication BypassEPSS 0.6%CVE-2024-9862CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password ChangeEPSS 0.6%CVE-2025-7665HIGHMiniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege EscalationEPSS 0.4%