CVE Alert: CVE-2025-7665 – cyberlord92 – Miniorange OTP Verification with Firebase

Risk verdict

High risk of unauthenticated privilege escalation on the affected WordPress OTP verification plugin; currently no evidence of active exploitation, but exposure is real and elevated.

Why this matters

An attacker can elevate themselves to Administrator without credentials, enabling full site compromise, backdoor installation, and data exposure. In practice, this undermines site integrity, trust, and regulatory posture, especially for sites handling user authentication or sensitive data.

Most likely attack path

The flaw enables unauthenticated access to a capability-limited function, relying on missing authorization checks. Exploitation requires the plugin to be active (and, per the disclosure, premium features may be involved), with an attacker sending crafted requests to modify the default user role. The CVSS metrics indicate remote, unauthenticated access with high impact, albeit with relatively high attack complexity and no user interaction.

Who is most exposed

WordPress sites using this plugin, particularly those on shared or public hosting with enabled premium features, are at risk. Environments with publicly accessible admin endpoints and OTP flows that rely on the plugin are most exposed.

Detection ideas

• Sudden creation or elevation of user accounts to Administrator.
• Unusual changes to the default role or plugin configuration via the affected handler.
• Logs showing requests to the plugin’s form-options handler without authentication.
• Anomalous admin-level actions following login attempts from previously unseen IPs.
• WAF or IDS alerts targeting the plugin endpoints.

Mitigation and prioritisation

• Update the plugin to a version beyond 3.6.2 or remove it if upgrade isn’t feasible.
• If patching, test in staging and apply during a controlled change window; ensure backups.
• Enforce least privilege: restrict unauthenticated access and disable premium features if not required.
• Apply compensating controls: WAF rules targeting the specific handler, and enhanced monitoring of admin-privilege changes.
• Communicate with hosting and change-management teams; verify governance around plugin updates.