The plugin’s Firebase OTP validation routine fails to verify that the phone number submitted with the OTP matches the phone number stored for the target user account. This oversight allows an attacker, without prior authentication, to obtain a valid Firebase session and supply any victim’s phone number to register or log in. Once logged in, the attacker gains full access to the victim’s WordPress account, including administrator accounts, enabling arbitrary content modifications, file uploads, or site takeover. The weakness is classified as CWE-287 (Improper Authentication).

WordPress sites that have installed the "OTP Login With Phone Number, OTP Verification" plugin by glboy, specifically versions 1.8.50 through 1.8.60. Users with any phone number registered in their WordPress profile are susceptible.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS data is available, and the issue is not currently listed in the CISA KEV catalog. The attack vector is remote, requiring only HTTP requests to the plugin’s AJAX endpoint and knowledge of a user’s phone number. Successful exploitation leads to complete account compromise, so the risk to affected sites is high and the exploitability is considered feasible for knowledgeable attackers who can acquire or guess phone numbers from publicly exposed profiles.