CVEvulnerability

CVE-2025-7665

8.1 HIGH Published 2025-09-19 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-09-19
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-862

Description

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability.

Weakness · CWE (1)

CWE-862 Missing Authorization weakness

References

https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/trunk/handler/forms/class-registrationform.php plugins.trac.wordpress.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a02910-5674-4266-ab6e-7926bf6adecc?source=cve www.wordfence.com

CVE-2025-7665

Description

Related

Weakness · CWE (1)

References