CVE-2025-8342
Last modified
CVE-2025-8342 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-8342?
How severe is CVE-2025-8342?
How do I fix CVE-2025-8342?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-8336A vulnerability classified as critical was found in Campcode…9.8
- CVE-2025-8337A vulnerability, which was classified as problematic, has be…5.4
- CVE-2025-8338A vulnerability was found in projectworlds Online Admission …9.8
- CVE-2025-8339A vulnerability was found in code-projects Intern Membership…9.8
- CVE-2025-8340A vulnerability was found in code-projects Intern Membership…6.1
- CVE-2025-8341Grafana is an open-source platform for monitoring and observ…5
- CVE-2025-8343A vulnerability was found in openviglet shio up to 0.3.8. It…9.8
- CVE-2025-8344A vulnerability classified as critical has been found in ope…9.8
- CVE-2025-8345A vulnerability classified as critical was found in Shanghai…9.8
- CVE-2025-8346A vulnerability, which was classified as problematic, has be…6.1
- CVE-2025-8347A vulnerability, which was classified as critical, was found…6.5
- CVE-2025-8348A vulnerability has been found in Kehua Charging Pile Cloud …7.5
Are you affected by CVE-2025-8342?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST