What’s Vulnerable › Vulnerabilities

CVE-2024-9863: Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-17 · updated 2026-06-17
• Weakness: CWE-266

Description

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.

Affected products

• miniOrange Otp Verification: through 3.6.0

References

• https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-registrationform.php#L194
• https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file4
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f04eab14-dd86-4145-b5eb-20d064bc8417?source=cve

Get alerted when CVE-2024-9863 or the next vulnerability affects your stack