Introduction
Attackers can seize control of any WordPress user account protected by the Orion SMS OTP Verification plugin if they know the associated phone number. Administrative and other privileged accounts are exposed too, so this critical flaw can lead to full compromise of any WordPress installation running an affected version of the plugin.
The Orion SMS OTP Verification plugin is a third-party WordPress extension developed by Orion Hive. It provides SMS-based one-time password (OTP) authentication and integrates with popular plugins such as Contact Form 7 and WooCommerce. It is less widely deployed than core WordPress components, but organizations use it to add SMS-based two-factor authentication to their sites. Orion Hive has released other authentication plugins, and some of them have also had privilege escalation vulnerabilities.
Technical Information
CVE-2025-9967 is a privilege escalation and authentication bypass vulnerability in the Orion SMS OTP Verification plugin for WordPress. All versions up to and including 1.1.7 are affected. The plugin's password reset mechanism does not properly validate the requester's identity before it allows a password change.
An attacker needs only the target user's phone number. Without authenticating, they can start a password reset for any account, and the plugin lets the password be set to a one-time password (OTP) without verifying that the requester is the legitimate account owner. The references for this flaw point to the plugin's reset-password.js file, which is part of the password reset workflow. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
No public code snippets are available for this vulnerability. The exploit needs no authentication or user interaction, and an attacker can carry it out remotely.
Affected Systems and Versions
- Orion SMS OTP Verification plugin for WordPress
- All versions up to and including 1.1.7
- Any WordPress configuration using this plugin is vulnerable if password reset via phone number is enabled
Vendor Security History
Orion Hive, the developer of this plugin, has a history of authentication-related vulnerabilities. Its Orion Login with SMS plugin, a separate product, was affected by CVE-2025-7692, which also allowed authentication bypass. The repeated pattern suggests systemic weaknesses in the vendor's secure development lifecycle and authentication design.
