Password Reset with Code <= 0.0.16 - Unauthenticated Privilege Escalation via Weak OTP Codes

The Password Reset with Code for WordPress REST API plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.0.16. This is due to the plugin not using cryptographically secure mechanisms for OTP generation This makes it possible for unauthenticated attackers to reset users, including administrators, passwords and leverage that to gain access to their accounts.