CVE-2026-3655 Overview
CVE-2026-3655 is an authentication bypass vulnerability in the OTP Login With Phone Number, OTP Verification plugin for WordPress. The flaw affects versions 1.8.50 through 1.8.60 and resides in the Firebase verification flow of the lwp_ajax_register AJAX handler. The handler fails to bind the Firebase session to the phone number supplied in the request, allowing unauthenticated attackers to authenticate as any registered user, including administrators. The vulnerability is classified under [CWE-287] Improper Authentication.
Critical Impact
Unauthenticated attackers can take over any WordPress account, including administrator accounts, by supplying a victim's phone number while verifying their own Firebase OTP session.
Affected Products
- OTP Login With Phone Number, OTP Verification plugin for WordPress version 1.8.50
- Versions 1.8.51 through 1.8.59 of the plugin
- OTP Login With Phone Number, OTP Verification plugin version 1.8.60
Discovery Timeline
- 2026-05-29 - CVE-2026-3655 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-3655
Vulnerability Analysis
The vulnerability stems from the idehweb_lwp_activate_through_firebase() function in inc/ajax-handlers.php. The function validates that a Firebase one-time password (OTP) session token is legitimate. However, it never compares the phoneNumber returned by Firebase against the phone number supplied in the AJAX request. As a result, the authentication decision relies on the attacker-controlled request parameter rather than the cryptographically verified session identity.
An attacker who controls any phone number can complete a legitimate Firebase OTP challenge for that number. The plugin treats the verified Firebase session as proof of identity for whatever phone number the attacker submits in the request body. The plugin then issues a WordPress session for the user record that has the supplied phone number stored in user meta.
Root Cause
The root cause is a missing identity binding check between the Firebase-verified phone number and the request parameter. The handler trusts the attacker-supplied phoneNumber field and uses it to look up the WordPress account, instead of using the value embedded in the Firebase token claims.
Attack Vector
The attack is unauthenticated and remote over the network. The attacker registers their own phone number with Firebase, completes the OTP challenge, and then sends an AJAX request to lwp_ajax_register containing the victim's phone number alongside the attacker's valid Firebase session token. The plugin authenticates the attacker as the victim and returns a valid WordPress session.
No verified exploit code is publicly indexed. The vulnerable code paths are referenced in the WordPress Plugin Trac for ajax-handlers.php line 1167 and the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-3655
Indicators of Compromise
- POST requests to admin-ajax.php with action=lwp_ajax_register originating from unexpected IP addresses or geographies.
- Successful WordPress administrator logins immediately following lwp_ajax_register AJAX calls in access logs.
- Creation of new administrator accounts, plugin installations, or theme edits performed by accounts that historically authenticate via password rather than OTP.
Detection Strategies
- Correlate web server access logs for lwp_ajax_register requests with subsequent privileged actions in WordPress audit logs.
- Alert on Firebase OTP verification events where the supplied phoneNumber parameter does not match the Firebase token's claimed phone number.
- Monitor wp_users and wp_usermeta tables for unexpected session token creation or session_tokens user meta updates for administrator accounts.
Monitoring Recommendations
- Enable verbose logging on the plugin's AJAX handlers and forward logs to a centralized SIEM for correlation.
- Track changes to administrator-level WordPress roles and capabilities, with real-time alerts on privilege changes.
- Baseline normal OTP login volume per site and alert on volumetric spikes that may indicate brute-forcing of phone number enumeration.
How to Mitigate CVE-2026-3655
Immediate Actions Required
- Update the OTP Login With Phone Number, OTP Verification plugin to a version newer than 1.8.60 that includes the fix from WordPress changeset 3479314.
- Audit all WordPress administrator and editor accounts for unexpected logins, password resets, or session tokens since deploying any affected version.
- Rotate credentials and invalidate active sessions for all privileged accounts on sites running affected versions.
Patch Information
The vendor addressed the issue in WordPress plugin changeset 3479314, which modifies inc/ajax-handlers.php to bind the Firebase-verified phone number to the request. Administrators should apply the latest plugin release through the WordPress dashboard or via WP-CLI. Review the Wordfence advisory for the fixed version metadata.
Workarounds
- Deactivate and remove the OTP Login With Phone Number plugin until the patched version is installed.
- Restrict access to wp-admin/admin-ajax.php for the lwp_ajax_register action via a web application firewall (WAF) rule.
- Temporarily disable Firebase-based authentication flows in the plugin settings and require traditional password authentication with multi-factor authentication.
# Configuration example: update the plugin via WP-CLI
wp plugin update login-with-phone-number
wp plugin list --name=login-with-phone-number --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
