CVE-2025-9967

CriticalCVSS 9.8/10Last modified Sep 26, 2026

Description

The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2025
Last modified: Sep 26, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-99688.5A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a spec CVE-2025-99697.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Pa CVE-2025-99707.4Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.CVE-2025-99719.8Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthent CVE-2025-99729.8Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenti CVE-2025-99737.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authen CVE-2025-99748.0The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended CVE-2025-99756.8The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scra CVE-2025-99769.0An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Relea CVE-2025-99775.3Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which CVE-2025-99786.8The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cros CVE-2025-99794.3The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks