CVE-2025-8342: high-severity vulnerability in glboy OTP Login With Phone Number, OTP…
WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.7%
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
glboy · OTP Login With Phone Number, OTP VerificationRelated CVEs — glboy OTP Login With Phone Number, OTP…
In the same product, most dangerous first.
CVE-2024-5150CRITICALLogin with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value CheckEPSS 0.8%CVE-2026-3655CRITICALOTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP VerificationEPSS 0.5%CVE-2024-6482HIGHLogin with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege EscalationEPSS 0.5%CVE-2024-6125HIGHLogin with phone number <= 1.7.34 - Insecure Password Reset MechanismEPSS 0.5%CVE-2023-4916HIGHLogin with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password ChangeEPSS 0.4%
References
https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4358https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4373https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338150%40login-with-phone-number&new=3338150%40login-with-phone-number&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/6e74582f-8e94-4cba-a3eb-0a823a5235ad?source=cve