What is the CVSS score of CVE-2026-3655?

CVE-2026-3655 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of OTP Login Plugin are affected by CVE-2026-3655?

The OTP Login With Phone Number plugin for WordPress (versions 1.8.50-1.8.60) contains a critical authentication bypass allowing any unauthenticated attacker to log in as any user, including…

How to fix or mitigate CVE-2026-3655?

Within 24 hours: Disable the OTP Login With Phone Number plugin and review authentication logs for unauthorized access since deployment. Within 7 days: Remove the plugin entirely and enforce password resets for all user accounts; monitor vendor advisories for patched versions. Within 30 days: Deploy alternative MFA (Authy, Google Authenticator, Duo via third-party plugins) and audit all user roles and permissions for unauthorized changes.

OTP Login Plugin CVE-2026-3655

EUVD-2026-33255 CRITICAL

Improper Authentication (CWE-287)

2026-05-29 Wordfence

GHSA-8p28-978j-q34v

WordPress Authentication Bypass

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 08:14 vuln.today

CVE Published

May 29, 2026 - 06:43 nvd

CRITICAL 9.8

DescriptionCVE.org

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the lwp_ajax_register AJAX handler not binding the Firebase session to the phone number supplied in the request. The idehweb_lwp_activate_through_firebase() function validates that a Firebase OTP session is legitimate, but the phoneNumber returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.

AnalysisAI

Authentication bypass in the OTP Login With Phone Number, OTP Verification WordPress plugin versions 1.8.50 through 1.8.60 allows unauthenticated remote attackers to log in as any user - including administrators - whose phone number is stored in user meta. The flaw stems from the Firebase OTP verification flow failing to bind the verified Firebase session to the phone number supplied in the request, so attackers can verify their own phone via Firebase and then submit a victim's number to be authenticated as that victim. No public exploit identified at time of analysis, but the trivial logic flaw and CVSS 9.8 score make this a critical priority.

Technical ContextAI

The vulnerability resides in the lwp_ajax_register AJAX handler of the login-with-phone-number plugin (vendor: glboy), which integrates Google Firebase Authentication as a phone-based OTP mechanism for WordPress accounts. The idehweb_lwp_activate_through_firebase() function correctly validates the cryptographic legitimacy of a Firebase ID token but never cross-checks the phoneNumber claim returned inside that token against the phone parameter the client submits to identify the target WordPress user. This is a textbook CWE-287 (Improper Authentication) flaw: authentication is verified for one identity (the attacker's Firebase session) while authorization/session establishment is granted for a different identity (the victim's WordPress account), breaking the binding between authenticator and principal. Source references point to ajax-handlers.php lines 649, 659, and 1167 in the affected branch and to changeset 3479314 in the trunk for the fix.

RemediationAI

Upstream fix available (commit/changeset 3479314 on the plugin's trunk); a released patched version beyond 1.8.60 is not independently confirmed in the provided data, so administrators should update to the latest plugin release available on wordpress.org once it is published past 1.8.60 and verify the changeset at https://plugins.trac.wordpress.org/changeset/3479314/login-with-phone-number/ is included. As an immediate compensating control, deactivate and remove the OTP Login With Phone Number plugin until a fixed version is installed - the trade-off is that any users who rely exclusively on phone-based OTP login will lose access and must use standard WordPress username/password recovery. If the plugin cannot be removed, block unauthenticated POST requests to the lwp_ajax_register AJAX action (admin-ajax.php?action=lwp_ajax_register) at a WAF or reverse proxy, accepting the side effect that legitimate new-user registrations via this flow will also break. Auditing user_meta for phone numbers associated with administrator and editor accounts and temporarily clearing them is an additional stopgap that prevents the specific bypass while leaving the plugin installed.