Description

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-26T12:16:20.940Z",
  "pubdate": "2026-08-26T12:16:20.940Z",
  "executiveSummary": "The Classified Listing - Mobile Number Verification plugin for WordPress is susceptible to an Authentication Bypass vulnerability, identified in all versions up to and including 1.6.0.\nThe flaw resides in the process_otp_login() function, which lacks mandatory server-side validation of Firebase One-Time Passwords (OTP).\nThis critical security deficit allows unauthenticated remote attackers to impersonate any user, provided the target has a phone number registered within the plugin's internal database.\nExploitation requires that the 'Firebase' verification gateway be enabled for OTP logins. By supplying arbitrary UID and OTP values, an attacker can bypass the authentication handshake.\nThe impact is significant, as successful exploitation enables full account takeover, including administrative accounts if they are associated with a registered phone number. This vulnerability facilitates unauthorized access to sensitive user data, potential modification of listings, and total site compromise if an administrator account is targeted.\nThis vulnerability is classified as an authentication bypass that does not require prior credentials, posing a high risk to installations where Firebase OTP verification is actively deployed.",
  "technicalDetails": "The vulnerability originates from a logic flaw within the process_otp_login() function, which handles the verification phase of the Firebase OTP login flow. The implementation fails to perform a server-side verification of the provided OTP token against the Firebase backend API.\nIn a secure implementation, the plugin should receive an authentication token from the client, verify the authenticity and validity of that token with Firebase's verification service, and only then proceed to authenticate the user session. Instead, the plugin trustingly accepts the client-provided UID and OTP parameters without independently confirming their authenticity.\nThe exploitation process follows a predictable pattern. An attacker identifies the target user's registered phone number, which is stored in the plugin's phone table. Once the 'Firebase' gateway is configured, the attacker initiates a crafted request to the process_otp_login() function.\nBecause the server-side code does not validate the Firebase token, the attacker can provide arbitrary values for the OTP and the UID. The function blindly treats the provided UID as a legitimate reference to the target user account, effectively bypassing the identity verification process entirely.\nStep-by-step, the attack flow manifests as follows: First, the attacker determines the target's phone number. Second, the attacker triggers the vulnerable process_otp_login() endpoint, injecting the target's UID alongside a dummy OTP. Third, the plugin processes the request without backend validation, erroneously verifying the user session. Finally, the server issues a session token or redirects the attacker as the authenticated victim.\nThis flaw effectively nullifies the purpose of the authentication mechanism, granting the attacker the permissions associated with the targeted user account. Because this occurs at the application layer, it is accessible via standard network requests, requiring no interaction from the targeted user. If an administrator is the target, the attacker gains full site management capabilities. This vulnerability is prevalent in all versions up to 1.6.0."
}