Latest posts
-
The OTP Plugin Protecting Your Login Has a Flaw That Makes It Worthless
A plugin called User Verification by PickPlugins adds a one-time password step to your WordPress login. The idea is good — a second check before anyone gets in. The implementation has a bug that cancels the whole thing. An attacker types “true” as their OTP code. PHP accepts it. They are logged in as any…