CVE-2026-3655

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.

• CWE-287

• https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L1167
• https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L649
• https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L659
• https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/inc/ajax-handlers.php#L649
• https://plugins.trac.wordpress.org/changeset/3479314/login-with-phone-number/trunk/inc/ajax-handlers.php?old=3455810&old_path=login-with-phone-number%2Ftrunk%2Finc%2Fajax-handlers.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc410f2-5f2b-4eea-a0fb-fe58f988f95f?source=cve

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36521PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulne…6.1
• CVE-2026-3653Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-36537ThingsBoard v4.3.0.1 is vulnerable to an authentication bypa…9.8
• CVE-2026-36538Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded r…7.3
• CVE-2026-36539Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint …7.3
• CVE-2026-36540Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauth…7.3
• CVE-2026-3657The My Sticky Bar plugin for WordPress is vulnerable to SQL …7.5
• CVE-2026-36574A DLL hijacking vulnerability in Wassimulator (GitHub) Cactu…7.8
• CVE-2026-36576An OS command injection vulnerability in the app.py componen…9.8
• CVE-2026-3658The Appointment Booking Calendar — Simply Schedule Appointme…7.5
• CVE-2026-3659The WP Circliful plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-36590An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to …7.5