pocpioneer/cve-2025-4094-pocWordPress Plugin Digits < 8.4.6.1 - OTP Auth Bypass via Bruteforce (CVE-2025-4094)
This script is an exploit for the WordPress Plugin Digits (versions < 8.4.6.1) that allows for OTP (One-Time Password) authentication bypass via brute force. The exploit leverages a vulnerability identified as CVE-2025-4094. The script has been modified to utilize ThreadPoolExecutor for parallel attacks, significantly speeding up the brute-force process.
Exploit Author: Saleh Tarawneh
requests libraryargparse library (included in Python standard library)colorama libraryYou can install the required libraries using pip:
pip install -r requirements.txt
To run the script, use the following command:
python3 otp_bypass.py -u <TARGET_URL> -p <PHONE_NUMBER> -i <INSTANCE_ID> [OPTIONS]
-u, --url: (Required) Target URL (e.g., https://example.com/wp-admin/admin-ajax.php)-p, --phone: (Required) Target phone number (digits only)-i, --instance-id: (Required) Instance ID from intercepted request-d, --digits: (Optional) OTP length (4 or 6 digits, default is 4)-w, --workers: (Optional) Number of parallel workers (default is 10)--start: (Optional) Starting OTP value (default is 0)--end: Ending OTP value (default: 9999 for 4-digit, 999999 for 6-digit)python3 otp_bypass.py -u https://example.com/wp-admin/admin-ajax.php -p 1234567890 -i <INSTANCE_ID> -d 4 -w 10
The script will display progress and results in the terminal. If a valid OTP is found, it will print the successful OTP and a snippet of the response from the server.
Use responsibly and only on authorized systems. Unauthorized access to systems is illegal and unethical. This script is intended for educational purposes and security testing with permission.
This project is licensed under the MIT License. See the LICENSE file for details.
The author and contributors are not responsible for any misuse or damage caused by this script. Always ensure you have permission to test the systems you are targeting.
--proxy: (Optional) Proxy (e.g., http://127.0.0.1:8080)