Authentication Bypass in OTP Login With Phone Number Plugin for WordPress

CVE-2026-3655

What is CVE-2026-3655?

The OTP Login With Phone Number plugin for WordPress has a security flaw that allows unauthorized users to bypass authentication. This vulnerability stems from the Firebase verification flow within the lwp_ajax_register AJAX handler, which fails to bind the Firebase session to the corresponding phone number provided in the request. Although the function idehweb_lwp_activate_through_firebase() does check the validity of a Firebase OTP session, it neglects to compare the phoneNumber returned by Firebase against the stored phone number of the intended user. As a result, attackers can exploit this oversight to authenticate as any user with a registered phone number, which may include administrative accounts, simply by verifying their own Firebase session alongside the target's phone number.

References