EUVD-2026-66410
GHSA-xhwf-539m-8chw
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects mandatory non-default Firebase OTP configuration and phone number knowledge; PR:N confirmed by unauthenticated nature of the bypass.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
AnalysisAI
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default conditions to be satisfied simultaneously: (1) The Firebase OTP login feature must be explicitly enabled in the plugin's settings and Firebase must be selected as the verification gateway - default WordPress installations have no such feature, and the plugin must be actively configured to use Firebase; (2) The attacker must know or successfully guess the registered phone number of the target account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the dual-natured risk profile: network-exploitable and unauthenticated, but gated behind AC:H due to two non-trivial preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Classified Listing - Mobile Number Verification plugin to a version beyond 1.6.0 as soon as a patched release is confirmed by the vendor at https://www.radiustheme.com/downloads/classified-listing-mobile-no-verification/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites using Classified Listing - Mobile Number Verification plugin versions 1.6.0 and earlier, and immediately disable or uninstall the plugin pending vendor patch release. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-289 – Authentication Bypass by Alternate Name
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today