CVE-2026-15985
Received Received - Intake

Authentication Bypass in Classified Listing WordPress Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Wordfence

Description
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-15985
EUVD
EUVD-2026-66410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpwhitesecurity mobile_number_verification to 1.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin up to version 1.6.0. It occurs because the Firebase OTP validation is missing in the process_otp_login() function. Attackers can bypass authentication by submitting an arbitrary OTP code and UID through the Firebase OTP login flow if they know a target user's phone number and OTP login is enabled with Firebase as the verification gateway.

Detection Guidance

Check if the Classified Listing - Mobile Number Verification plugin is installed and active. Review server logs for unusual authentication attempts via the Firebase OTP login flow. Look for failed login attempts or successful logins with arbitrary OTP codes.

Impact Analysis

Unauthenticated attackers can gain access to any user account with a registered phone number by exploiting this flaw. If an administrator account has a phone number registered, the attacker can take over the entire site. This could lead to unauthorized data access, site defacement, or further compromise of the WordPress installation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update the plugin to the latest version if available. Disable Firebase OTP login if not required. Restrict access to the plugin's phone number table. Monitor for unauthorized admin account access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart