How many vulnerabilities does Mersal OTP have?

The audit found 245 findings: 4 critical, 28 high, 133 medium severity.

Should I use Mersal OTP?

Based on the latest audit (grade D, risk CRITICAL), review the 245 findings on this page before deciding — higher-risk findings should be weighed against the plugin's alternatives.

Mersal OTP

Q: Is Mersal OTP secure?

WP HealthKit's independent audit rates Mersal OTP overall risk as CRITICAL with a report-card grade of D.

Audited at release

v1.36.0WordPress PluginAudited Today

Passwordless login, sign-up and WooCommerce checkout verification with one-time codes by email, WhatsApp, Telegram, SMS or voice call.

CRITICAL

Total Findings

245

Security Grade

Coding Score

94/100

Security Findings

245

Critical4

High28

Medium133

Low77

Info3

Executive Summary

Is Mersal OTP secure? In WP HealthKit's independent 2026 audit, Mersal OTP received an overall risk of CRITICAL and a report-card grade of D across 245 findings (4 critical, 28 high severity).

Directory audit — deterministic scanners only (Wordfence, OSV, PHPCS, PHPStan, Semgrep, Psalm, compat). Sign in and run a full audit for AI-grade analysis (security, quality, accessibility).

Security Report Card

Readiness

Coding Standards

94/100

PHP Compatibility

Requires PHP 5.6Declared minimum: 7.4

Categories with Findings

SecurityssrfHardcoded SecretsGDPRPlugin LifecycleCoding StandardsTheme StandardsUpdate SafetySQL InjectionType SafetyWooCommerce CompatibilityMalware & Nulled PluginHook WiringPerformanceInternationalizationDatabaseAI-Generated CodeFile SecurityWordPress CompatibilityPlugin Conflictscompatibility

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![Mersal OTP security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/mersal-otp)](https://wphealthkit.com/directory/mersal-otp)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Site owners: should they update?

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Readiness

Coding Standards

94/100

PHP Compatibility

Requires PHP 5.6Declared minimum: 7.4

Mersal OTP

Security Findings

Executive Summary

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Plugin Info

Embed

Are you the developer?

Audit Your Plugin

Readiness

PHP Compatibility

Categories with Findings