CVE-2025-7665: high-severity vulnerability in cyberlord92 Miniorange OTP Verification with…
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.4%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cyberlord92 · Miniorange OTP Verification with FirebaseRelated CVEs — cyberlord92 Miniorange OTP Verification with…
In the same product, most dangerous first.
CVE-2024-9861HIGHMiniorange OTP Verification with Firebase <= 3.6.0 - Authentication BypassEPSS 0.6%CVE-2024-9862CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password ChangeEPSS 0.6%CVE-2024-9863CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role ValueEPSS 0.6%