CVE-2026-3655
Deferred Deferred - Pending Action
Authentication Bypass in OTP Login With Phone Number WordPress Plugin

Publication date: 2026-05-29

Last updated on: 2026-05-29

Assigner: Wordfence

Description
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-29
Last Modified
2026-05-29
Generated
2026-05-29
AI Q&A
2026-05-29
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
idehweb otp_login_with_phone_number From 1.8.50 (inc) to 1.8.60 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The vulnerability exists in the OTP Login With Phone Number, OTP Verification plugin for WordPress, specifically in versions 1.8.50 through 1.8.60. It is an authentication bypass issue caused by the Firebase verification flow in the `lwp_ajax_register` AJAX handler not properly binding the Firebase session to the phone number supplied in the request.

Although the function `idehweb_lwp_activate_through_firebase()` validates that a Firebase OTP session is legitimate, it does not compare the phone number returned by Firebase against the victim's stored phone number. This flaw allows unauthenticated attackers to authenticate as any user who has a phone number stored in user meta by verifying their own Firebase session and supplying the victim's phone number in the same request.


How can this vulnerability impact me? :

This vulnerability can have severe impacts because it allows unauthenticated attackers to bypass authentication and impersonate any user, including administrators, by exploiting the phone number verification flaw.

  • Attackers can gain unauthorized access to user accounts.
  • Attackers can escalate privileges by impersonating administrators.
  • Compromise of sensitive data and site control is possible.
  • The vulnerability has a high CVSS score of 9.8, indicating critical severity with impacts on confidentiality, integrity, and availability.

Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart