Executive Summary

The vulnerability exists in the OTP Login With Phone Number, OTP Verification plugin for WordPress, specifically in versions 1.8.50 through 1.8.60. It is an authentication bypass issue caused by the Firebase verification flow in the `lwp_ajax_register` AJAX handler not properly binding the Firebase session to the phone number supplied in the request.

Although the function `idehweb_lwp_activate_through_firebase()` validates that a Firebase OTP session is legitimate, it does not compare the phone number returned by Firebase against the victim's stored phone number. This flaw allows unauthenticated attackers to authenticate as any user who has a phone number stored in user meta by verifying their own Firebase session and supplying the victim's phone number in the same request.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to bypass authentication and impersonate any user, including administrators, by exploiting the phone number verification flaw.

• Attackers can gain unauthorized access to user accounts.
• Attackers can escalate privileges by impersonating administrators.
• Compromise of sensitive data and site control is possible.
• The vulnerability has a high CVSS score of 9.8, indicating critical severity with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0