# OTP Login With Phone Number, OTP Verification <= 1.8.77 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Address Takeover via Email Change

- **ID:** WPSEC-2026-0987
- **Plugin:** OTP Login With Phone Number, OTP Verification (`login-with-phone-number`), https://wordpress.org/plugins/login-with-phone-number/
- **Affected versions:** all versions before 1.8.78
- **Fixed in:** 1.8.78 (Update to 1.8.78 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/login-with-phone-number
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0987/

## Description

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to Insecure Direct Object Reference via the email-change flow (lwp_ajax_verify_with_email and lwp_activate_email AJAX actions) in all versions up to, and including, 1.8.77. This is due to the plugin accepting an email address already owned by another account as the pending address, and not binding the activation code to that pending address. Any code issued to the requesting user, for example to their own email address, is therefore accepted. On successful verification the plugin removes the email address from the other account and assigns it to the requester. This makes it possible for authenticated attackers, with subscriber-level access and above, to remove any user's email address, including an administrator's, and claim it for their own account.

## References

- https://wpsec.com/vuln/WPSEC-2026-0987/
- https://plugins.svn.wordpress.org/login-with-phone-number/tags/1.8.78/
- https://wordpress.org/plugins/login-with-phone-number/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0987/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.