Security Alert Summary
The Classified Listing – Mobile Number Verification plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-15985). Missing server-side Firebase OTP validation in the plugin’s login flow can allow unauthenticated attackers to authenticate as users who have phone numbers registered in the plugin, if OTP login is enabled and Firebase is selected as the verification gateway.
CVE Details
- CVE ID: CVE-2026-15985
- Affected component: Classified Listing – Mobile Number Verification plugin for WordPress
- Affected versions: All versions up to and including 1.6.0
- Published: August 26, 2026 at 12:16 PM UTC
- Last modified: August 26, 2026 at 4:19 PM UTC
- CVSS v3.1: Base score 8.1, severity HIGH, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N). Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway and knowledge or guessing of the target account phone number.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-289 (Authentication bypass)
Technical Details
The vulnerability is caused by missing server-side Firebase OTP validation in the plugin’s process_otp_login() function. Because the server-side flow does not validate Firebase OTP responses properly, an attacker can submit an arbitrary OTP code and UID through the Firebase OTP login flow and be authenticated as any user with a phone number recorded in the plugin’s phone table.
Exploitation requires that the plugin’s OTP login feature is enabled and Firebase is selected as the verification gateway. An attacker must know or guess the phone number associated with the target account. The report notes that administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
How This Could Impact Your Website
In a multi-user WordPress environment, this vulnerability could enable an external attacker to authenticate as an internal staff member, contributor, or even an administrator if that user has a phone number registered with the plugin. For example, an external contractor who knows or can guess an editor’s phone number could gain access to the editor account and perform actions on the site under that identity. If an administrator’s phone number is registered, the attacker could gain administrator-level access.
Practical consequences include exposure of internal user email addresses and other account details, and an increased risk of targeted phishing or social engineering against staff and contributors using information obtained from compromised accounts. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Ensure OTP login and verification gateway settings are reviewed; disable OTP login or Firebase as the gateway if not required.
- Review and reduce unnecessary user roles, especially contributor and editor roles that do not require elevated access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual authentication events or account access patterns.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
