Classified Listing Mobile Verification CVE-2026-15985

Exploitation requires two non-default conditions to be satisfied simultaneously: (1) The Firebase OTP login feature must be explicitly enabled in the plugin's settings and Firebase must be selected as the verification gateway - default WordPress installations have no such feature, and the plugin must be actively configured to use Firebase; (2) The attacker must know or successfully guess the registered phone number of the target account. For administrator account takeover specifically, an administrator must additionally have a phone number registered in the plugin's phone table. What limits exploitation: sites using a different OTP provider (not Firebase) are not vulnerable via this path; sites where no admin has a registered phone number limit the impact to non-admin account takeover; phone number knowledge is a non-trivial prerequisite that blocks purely opportunistic mass exploitation. Authentication requirements are confirmed unauthenticated (PR:N in the CVSS vector), meaning no WordPress login is needed prior to exploitation.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the dual-natured risk profile: network-exploitable and unauthenticated, but gated behind AC:H due to two non-trivial preconditions. Real-world exploitation requires Firebase OTP to be explicitly enabled in the plugin settings and the attacker to know or enumerate the target account's registered phone number - neither of which is guaranteed. Sites using SMS OTP for authentication typically expose phone numbers in profile pages or via enumeration, partially lowering the practical barrier. For sites where an administrator has registered a phone number in the plugin's phone table, the impact ceiling is complete site compromise. No EPSS score was provided in the intelligence, no POC has been identified, and the vulnerability is absent from CISA KEV. The risk is therefore real but conditional: organizations running the plugin with Firebase OTP active and admin accounts enrolled in the phone table should treat this as high priority; all others face substantially lower realistic risk despite the raw CVSS score.

An attacker identifies a WordPress site running the Classified Listing - Mobile Number Verification plugin with Firebase OTP enabled, and obtains or guesses an administrator's phone number (via profile pages, leaked data, or enumeration). The attacker crafts an HTTP request to the plugin's OTP login handler, submitting the admin's phone number UID alongside an arbitrary OTP value. Because process_otp_login() performs no server-side Firebase token validation, the server accepts the request and issues a valid WordPress authentication session for the administrator account, granting full site control.