Miniorange OTP Verification With Firebase vulnerabilities

2 CVEs affecting Miniorange OTP Verification With Firebase, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-9862, published 2024-10-17.

More from Miniorange.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-9861, published 2024-10-17. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being…
• CVE-2024-9862, published 2024-10-17. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing…