CVE-2026-3655
Authentication Bypass in OTP Login With Phone Number WordPress Plugin
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| idehweb | otp_login_with_phone_number | From 1.8.50 (inc) to 1.8.60 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the OTP Login With Phone Number, OTP Verification plugin for WordPress, specifically in versions 1.8.50 through 1.8.60. It is an authentication bypass issue caused by the Firebase verification flow in the `lwp_ajax_register` AJAX handler not properly binding the Firebase session to the phone number supplied in the request.
Although the function `idehweb_lwp_activate_through_firebase()` validates that a Firebase OTP session is legitimate, it does not compare the phone number returned by Firebase against the victim's stored phone number. This flaw allows unauthenticated attackers to authenticate as any user who has a phone number stored in user meta by verifying their own Firebase session and supplying the victim's phone number in the same request.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows unauthenticated attackers to bypass authentication and impersonate any user, including administrators, by exploiting the phone number verification flaw.
- Attackers can gain unauthorized access to user accounts.
- Attackers can escalate privileges by impersonating administrators.
- Compromise of sensitive data and site control is possible.
- The vulnerability has a high CVSS score of 9.8, indicating critical severity with impacts on confidentiality, integrity, and availability.