CVE-2026-3655: OTP Login WordPress Plugin Auth Bypass via Firebase Session Mismatch

Executive Summary

A critical authentication bypass vulnerability (CVE-2026-3655) has been discovered in the OTP Login With Phone Number, OTP Verification plugin for WordPress, affecting versions 1.8.50 through 1.8.60. The flaw carries a CVSS score of 9.8 and enables unauthenticated account takeover.

The vulnerability exists in the plugin's Firebase-based OTP verification flow. During the lwp_ajax_register AJAX handler, the plugin verifies a Firebase session token but does not bind that session to the phone number supplied in the login request. An attacker can therefore present a valid Firebase session (obtained for their own phone number) alongside a victim's phone number, triggering authentication as the victim's account without possessing the victim's OTP or credentials.

WordPress site administrators running versions 1.8.50 through 1.8.60 of this plugin should update to a patched release immediately.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The OTP Login With Phone Number plugin allows WordPress users to authenticate via phone-based OTP. The flow integrates with Firebase Authentication, where a user provides their phone number, receives an OTP via SMS, and Firebase verifies the code and issues a session token.

The critical flaw: the plugin's lwp_ajax_register AJAX handler validates the Firebase token as authentic but does not verify that the token's associated phone number matches the phone number submitted in the login request.

This creates a classic token/identity mismatch vulnerability analogous to OAuth email mismatch issues.

Attack Flow

1. Attacker registers their own phone number with the target WordPress site
2. Attacker completes Firebase OTP verification for their own phone number,
   obtaining a valid Firebase session token (firebase_idToken)
3. Attacker identifies or enumerates a victim's phone number on the site
4. Attacker submits a crafted POST request to wp-admin/admin-ajax.php:
   - action: lwp_ajax_register
   - firebase_idToken: [attacker's valid token from step 2]
   - phone_number: [victim's phone number]
5. Plugin verifies the Firebase token — it is valid (attacker's real token)
6. Plugin retrieves the WordPress user associated with the victim's phone number
7. Plugin creates an authenticated session for the victim's account
8. Attacker is now logged in as the victim without knowing their OTP or password

Why Nonce and Token Validation Are Insufficient

The Firebase ID token proves the attacker authenticated with Firebase using their own phone. It does not prove any relationship between the attacker and the victim's phone number. By accepting a valid token regardless of the phone number it was issued for, the plugin allows trivial account takeover of any phone-registered user.

Impact Assessment

Immediate Remediation

Step 1: Update the Plugin

Update OTP Login With Phone Number, OTP Verification to a version beyond 1.8.60 that includes a fix for this vulnerability.

# Via WP-CLI
wp plugin update login-with-phone-number
 
# Verify installed version
wp plugin get login-with-phone-number --field=version

Or navigate to WordPress Admin > Plugins > Installed Plugins > OTP Login With Phone Number > Update.

Step 2: Disable Phone-Based OTP Login

If an update cannot be applied immediately, disable the plugin or the phone login feature:

# Deactivate via WP-CLI
wp plugin deactivate login-with-phone-number

Alternatively, disable the OTP login feature in the plugin's settings panel if that option is available.

Step 3: Audit for Account Compromise

# Check for suspicious login sessions (if audit logging is enabled)
wp db query "SELECT user_login, user_email, user_registered FROM wp_users
  WHERE user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY);"
 
# Review user meta for unexpected phone number associations
wp db query "SELECT user_id, meta_key, meta_value FROM wp_usermeta
  WHERE meta_key LIKE '%phone%' ORDER BY user_id;"
 
# List administrator accounts for unauthorized entries
wp user list --role=administrator --fields=user_login,user_email,user_registered

Step 4: Force Re-Authentication

# Invalidate all active sessions (force re-login for all users)
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"
 
# Regenerate WordPress secret keys and salts
wp config shuffle-salts

Detection Indicators

Post-Remediation Checklist

1. Update the plugin to version 1.8.61 or later
2. Disable phone OTP login if update is delayed
3. Invalidate all active WordPress sessions via session token deletion
4. Regenerate secret keys with wp config shuffle-salts
5. Audit all user accounts — look for unexpected profile changes
6. Review web server logs for lwp_ajax_register AJAX traffic
7. Enable two-factor authentication on all administrator accounts (separate mechanism)
8. Consider WAF rules to rate-limit or monitor OTP login AJAX calls
9. Notify affected users if exploitation is detected

References

• NVD — CVE-2026-3655
• Wordfence Vulnerability Database
• Firebase Authentication Documentation — ID Token Verification