OTP Login With Phone Number, OTP Verification <= 1.8.60 — Unauthenticated Authentication Bypass via Firebase OTP Verification

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under OTP Login With Phone Number, OTP Verification.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 1.8.61, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch OTP Login With Phone Number, OTP Verification to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to lucky_buddy.

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 28, 2026

   CVE published

   Severity critical, CVSS 9.8

2. Nov 13, 2026

   Record last updated