Hello,
\nI have found that it\u2019s very easy to hack a user account with this plugin.<\/p>\n
I explain.
\nIf we keep default setting, so 4 digit code and an expired time of 15 minutes (900seconds) and the fact that WordPress allow 50 request per seconds and per IP by default (even a poor server can handle more than 10 rest API requests per seconds) then in a case that attacker uses only one IP it would take approximately 200 seconds (less than 4 minutes) to reset a password.<\/p>\n
If you change digit number, it will approximately take :<\/p>\n
5 digits : 2000 seconds (33 minutes)
\n6 digits : 200000 seconds (333 minutes -> 5,5hours)
\n7 digits : 55 hours
\n8 digits : 23 days
\n9 digits : 231 days
\n10 digits : 2314 days …<\/p>\n
2314 days could seem a lot but don\u2019t forget here that\u2019s we use only 1 IP.<\/p>\n
Hacker would more often use 10, 100 or 1000+ different IP<\/p>\n
Of course every 15 minutes (or more depends on the life of the code sent) you ask for a new code. (But if you still try the same range of number it won\u2019t affect the chance to finding the password).<\/p>\n
So even with a 7 digits code it will be easy to hack a WordPress admin account in less than 6 minutes using only 10 different IP.<\/p>\n
Here are some suggestions to avoid this :<\/p>\n
Send a unique link after a password has been updated to enable the account.
\nSend by email a new password instead of asking the user to add his own.
\nAllow non-digit number to the code generated.
\nIf more than 10 bad code entered, block for 10 minutes or more, the API endpoint for the user. \u2014> I think this is a great solution.<\/p>\n
Also, I think that it should have an option to block resetting passwords of an admin account with this method.<\/p>\n
What do you think of ?<\/p>\n
Kind regards<\/p>\n","protected":false},"template":"","class_list":["post-13136269","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/13136269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/13136269\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=13136269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}