The vulnerability exists in the WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress. It arises from insufficient validation of empty values in the lwp_ajax_register function, leading to improper error handling of the Firebase API when the API key is not configured. As a result, unauthenticated attackers can bypass OTP verification and gain administrative access to any user account that has a configured phone number. This flaw falls under CWE‑862, Missing Authorization, and enables a complete disruption of authentication controls.

Affected are all installations of the glboy "Login with Phone Number, OTP Verification" plugin up to and including version 1.8.47. Users running this WordPress plugin, often in WooCommerce sites, and whose Firebase API key is not set, are impacted.

The vulnerability has a CVSS score of 8.1, indicating high severity, but the EPSS score is below 1 %, showing a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is remote and unauthenticated, where an attacker sends a crafted AJAX request to the lwp_ajax_register endpoint and triggers the bypass by exploiting the absent API key configuration. Successful exploitation results in immediate, privileged access to protected user accounts.