CVE-2026-15985: WordPress Classified Listing Auth Bypass

CVE-2026-15985 Overview

CVE-2026-15985 is an authentication bypass vulnerability in the Classified Listing - Mobile Number Verification plugin for WordPress. The flaw affects all versions up to and including 1.6.0. The plugin's process_otp_login() function fails to perform server-side Firebase One-Time Password (OTP) validation. Unauthenticated attackers can authenticate as any user whose phone number is registered in the plugin's phone table by submitting an arbitrary OTP code and user identifier (UID) through the Firebase OTP login flow. Administrator account takeover is possible if an administrator has a phone number registered in the plugin. The weakness is categorized under [CWE-289: Authentication Bypass by Alternate Name/Channel].

Critical Impact
Unauthenticated attackers can take over any WordPress account, including administrators, by supplying an arbitrary OTP and UID when Firebase OTP login is enabled.

Affected Products

Classified Listing - Mobile Number Verification plugin for WordPress
All versions up to and including 1.6.0
Deployments with OTP login enabled and Firebase selected as the verification gateway

Discovery Timeline

2026-08-26 - CVE-2026-15985 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15985

Vulnerability Analysis

The plugin exposes a Firebase-based OTP login flow that trusts client-supplied identifiers. When a user submits an OTP and UID to the process_otp_login() function, the plugin does not verify the OTP against Firebase on the server side. The function accepts any values provided in the request and matches the phone number against the plugin's phone table to establish an authenticated session.

Because validation is missing, attackers can bypass the OTP challenge entirely. Knowledge or discovery of a registered phone number is the only prerequisite. Administrator phone numbers registered with the plugin allow full site takeover, including plugin and theme modification, arbitrary PHP execution through admin functions, and user database access.

Root Cause

The root cause is missing server-side verification of Firebase OTP tokens. The plugin treats the client-provided OTP and UID as authoritative rather than validating them against Firebase Authentication using the Firebase Admin SDK. This is a classic [CWE-289] pattern where an alternate authentication channel accepts unverified assertions.

Attack Vector

Exploitation requires network access to the WordPress site with OTP login enabled and Firebase selected as the verification gateway. The attacker identifies or guesses a phone number registered in the plugin's phone table. The attacker then invokes the Firebase OTP login endpoint with a target phone number, an arbitrary OTP code, and an arbitrary UID. The plugin issues a session bound to the matching user account.

Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15985

Indicators of Compromise

Successful WordPress logins tied to the plugin's OTP endpoint without preceding Firebase verification traffic to Google endpoints
New administrator accounts, unexpected role changes, or password resets following requests to the plugin's OTP login handler
Repeated POST requests to the plugin's OTP login route enumerating phone numbers or UIDs

Detection Strategies

Review web server access logs for requests to the plugin's OTP login endpoint containing anomalous UID values or repeated attempts against the same phone number
Correlate WordPress wp_login events with the source of authentication; sessions established through OTP login without corresponding Firebase API calls warrant investigation
Audit the plugin's phone table for administrator accounts with registered phone numbers, which represent the highest-risk targets

Monitoring Recommendations

Alert on privilege escalation events, new administrator creation, and plugin or theme file modifications on sites running the affected plugin
Monitor authentication logs for logins from unusual IP addresses or geolocations directly following OTP endpoint activity
Track outbound calls from the WordPress host to Firebase authentication endpoints and flag OTP logins that occur without them

How to Mitigate CVE-2026-15985

Immediate Actions Required

Disable OTP login in the Classified Listing - Mobile Number Verification plugin, or switch the verification gateway away from Firebase until a patch is applied
Remove or nullify phone numbers registered against administrator accounts in the plugin's phone table
Force a password reset and terminate active sessions for all users with registered phone numbers

Patch Information

No fixed version is listed in the NVD entry at the time of publication. All versions up to and including 1.6.0 are affected. Monitor the RadiusTheme plugin download page and the Wordfence Vulnerability Report for a fixed release that implements server-side Firebase OTP verification.

Workarounds

Deactivate the plugin entirely if OTP login is not a business requirement
Restrict access to the WordPress login and plugin OTP endpoints using a Web Application Firewall (WAF) rule that blocks unauthenticated requests to the OTP login handler
Enforce a second authentication factor for administrator accounts through a separate, well-maintained WordPress two-factor authentication plugin

bash

# Example WAF rule concept: block unauthenticated POSTs to the plugin's OTP login endpoint
# Adjust the endpoint path and matching to your environment
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1015985,msg:'Block Classified Listing OTP login (CVE-2026-15985)'"
  SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
    "chain"
    SecRule ARGS:action "@rx process_otp_login"