Executive brief
A WordPress plugin used for phone-based login and verification contains a flaw that allows unauthorized individuals to log into any user account, including administrator accounts. By exploiting a weakness in how the system verifies phone numbers during the login process, an attacker can bypass security checks and gain full control over the website. This could lead to the theft of sensitive customer data, website defacement, or complete service disruption.
Technical details
The vulnerability is classified as an authentication bypass (CWE-287) within the Firebase verification flow of the `lwp_ajax_register` AJAX handler. The root cause is that the `idehweb_lwp_activate_through_firebase()` function validates the legitimacy of a Firebase OTP session but fails to verify that the phone number returned by Firebase matches the phone number provided in the login request. An unauthenticated attacker can exploit this by initiating a valid Firebase session with their own phone number and then submitting a request to the vulnerable WordPress endpoint using a victim's phone number. This allows the attacker to assume the identity of any user who has a phone number stored in their user metadata, including site administrators. A patch is available in version 1.8.61.
Affected products
- Idehweb OTP Login With Phone Number, OTP Verification 1.8.50 - 1.8.60
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory
References
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/inc/ajax-handlers.php
- https://plugins.trac.wordpress.org/changeset/3479314/login-with-phone-number/trunk/inc/ajax-handlers.php?old=3455810&old_path=login-with-phone-number%2Ftrunk%2Finc%2Fajax-handlers.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc410f2-5f2b-4eea-a0fb-fe58f988f95f?source=cve