OTP Login With Phone Number, OTP Verification <= 1.8.77 - Unauthenticated Authentication Bypass via Firebase Phone Number Verification
- ID
- WPSEC-2026-0988
- Plugin
- OTP Login With Phone Number, OTP Verification (login-with-phone-number)
- Affected
- from 1.8.61 before 1.8.78
- Remediation
- Update to 1.8.78 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- OTP Login With Phone Number, OTP Verification on WPSec AttackSurface
- Fix released
- Published
Description
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to Authentication Bypass via the 'phone_number' parameter of the lwp_ajax_register AJAX action in versions 1.8.61 up to, and including, 1.8.77. This is due to insufficient validation of the phone number during Firebase OTP verification. A non-numeric value leaves the phone number used for the user lookup empty, so the lookup can match an account whose stored phone number is empty. The check against the number verified by Firebase is then skipped, because it also accepted any suffix match and an empty requested number counts as a suffix of any number. This makes it possible for unauthenticated attackers who complete a Firebase verification for a phone number they control to log in as other users, which can include administrators, when the Firebase gateway is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0988/
- https://plugins.svn.wordpress.org/login-with-phone-number/tags/1.8.78/
- https://wordpress.org/plugins/login-with-phone-number/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS