Skip to content
Threat Feed

Product

OTP Login With Phone Number, OTP Verification Plugin

1 brief RSS
critical advisory

CVE-2026-3655: WordPress OTP Login Plugin Authentication Bypass Vulnerability

The OTP Login With Phone Number, OTP Verification plugin for WordPress versions 1.8.50 through 1.8.60 is vulnerable to authentication bypass due to improper validation of the Firebase session, allowing unauthenticated attackers to authenticate as arbitrary users, including administrators, by supplying a victim's phone number.

OTP Login With Phone Number, OTP Verification plugin authentication-bypass wordpress plugin cve-2026-3655 privilege-escalation
2r 1t 1c