CVE-2024-9862: 
WordPress vulnerability analysis and mitigation

The Miniorange OTP Verification with Firebase plugin for WordPress contains a critical vulnerability (CVE-2024-9862) affecting versions up to and including 3.6.0. The vulnerability allows arbitrary user password changes due to improper authorization controls and missing password verification checks (NVD).

The vulnerability stems from the plugin providing user-controlled access to objects and lacking proper authorization controls, specifically missing current password verification checks. The issue has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a highly severe vulnerability that requires no privileges or user interaction to exploit (NVD).

The vulnerability enables unauthenticated attackers to change user passwords and potentially take over administrator accounts, leading to complete system compromise. This poses a significant security risk as it allows unauthorized access to administrative functions and sensitive data (NVD).

The vulnerability can be exploited remotely by unauthenticated attackers. The attack requires no special privileges or user interaction, making it highly exploitable. The vulnerability allows bypassing authorization controls to access system resources (NVD).

Users should upgrade to a version newer than 3.6.0 which contains the security fix. The vulnerability was addressed in a subsequent release that implements proper authorization controls and password verification checks (NVD).