Authentication vulnerability in OTP Login Woocommerce & Gravity Forms 2.2

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is not secure. It is vulnerable to an attack where malicious users can bypass the authentication process. This is possible because the plugin sends login codes for administrators in an AJAX response. This means that even if the attacker doesn’t have access to the administrator’s phone number, they could still obtain the login code by using social engineering or reconnaissance.