Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in a popular WordPress plugin used for SMS alerts and notifications, potentially allowing unauthorized access to user accounts, including administrative privileges. This issue stems from an authentication bypass flaw that could enable attackers to impersonate legitimate users by exploiting the phone verification process.
- Bypass allows account takeover.
- Critical flaw affects WordPress users.
- Confirm relevance and exposure.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can bypass the authentication mechanism of the WordPress plugin by exploiting how it handles One-Time Password (OTP) verification. By controlling a phone number and completing its OTP validation, an attacker can then trick the system into issuing an authentication cookie for a different, targeted user by specifying that user's billing phone number in a subsequent registration request. This grants the attacker the ability to log in as any known or guessable user, including administrators.
- No login required.
- Completing OTP validation.
- Account takeover, including admin.
Live Threat
Current exploitation, exposure, and threat context
Unauthenticated attackers could potentially take over any user account, including administrator accounts, on a WordPress site that uses this plugin. This is possible when an attacker can guess or knows the phone number associated with a victim's account and can perform a successful OTP verification for a phone number they control.
- User account credentials.
- Via crafted registration requests.
- Full account takeover is possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and the platform team are likely responsible for addressing this vulnerability, as it affects a WordPress plugin used for customer interactions. The first critical step is to locate all instances of the affected plugin, confirm their accessibility from the internet, and determine their business criticality. Once these are understood, the accountable owner should be identified to plan and execute remediation, potentially involving vendor coordination or temporary risk reduction measures.
- Application owners and platform teams.
- Verify plugin presence and internet reachability.
- Plan remediation based on identified risk.
