Login with phone number, CVE-2025-8342

CVE, Research URL: CVE-2025-8342
Home page URL: Security reports for Login with phone number
Application: Login with phone number
Published on: Aug 15, 2025
Research Description: The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
Affected versions: max 1.8.48.
Status: vulnerable