Authentication Bypass in WooCommerce OTP Login Plugin for WordPress
CVE-2025-8342
8.1HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 August 2025
What is CVE-2025-8342?
The WooCommerce OTP Login With Phone Number plugin for WordPress contains a vulnerability that allows unauthenticated attackers to bypass OTP verification. Due to insufficient validation of empty values in the lwp_ajax_register function, attackers can exploit this weakness by improperly handling Firebase API errors, particularly when the Firebase API key is not configured. This flaw enables unauthorized access to user accounts that utilize a phone number for authentication, posing significant risks to account security.
Affected Version(s)
WooCommerce OTP Login With Phone Number, OTP Verification * <= 1.8.47