CVE-2025-4094

Unitedover Digits vulnerability

9.8 CRITICALPublic exploitEPSS 15.8%

Published21 May 2025

Description

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unitedover Digits< 8.4.6.1

Remediation

Fixed in

Unitedover Digits≥ 8.4.6.1

References

https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/ExploitThird Party Advisory

Frequently asked

Is CVE-2025-4094 being actively exploited?

CVE-2025-4094 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 15.8%.

How severe is CVE-2025-4094?

CVE-2025-4094 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 15.8% probability of exploitation.

Which products are affected by CVE-2025-4094?

Affected products include Unitedover Digits.

How do I fix CVE-2025-4094?

Upgrade affected software to a fixed version, for example Unitedover Digits 8.4.6.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-4094 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.