First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-4094

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	DIGITS: WordPress Mobile Number Signup and Login	< 8.4.6.1

References

https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/Exploit, Third Party Advisory

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-409404.9A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior CVE-2025-409414.3A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its respo CVE-2025-409427.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege e CVE-2025-409439.6Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering CVE-2025-409447.5A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6E CVE-2025-409456.7A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (Al CVE-2025-409468.3A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 1 CVE-2025-409477.5A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE CVE-2025-409486.8A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE CVE-2025-409499.1A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGE CVE-2025-40954.3Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed regis CVE-2025-40968.8Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a

CVE-2025-4094: Critical severity, CVSS 9.8 | Vulnix