CVE-2026-15985: Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Classified Listing - Mobile Number Verification pluginto a version that resolves this vulnerability.Fixed in 1.6.0 - Configuration
Ensure Firebase is not selected as the verification gateway for OTP login so the vulnerable flow (process_otp_login()) cannot be reached via unauthenticated attackers.
WordPress Classified Listing - Mobile Number Verification plugin Firebase OTP login (verification gateway) = disabled - Compensating control
If possible, disable OTP login in the Classified Listing - Mobile Number Verification plugin or ensure Firebase is not selected as the OTP verification gateway, to prevent unauthenticated Authentication Bypass via the Firebase OTP login flow.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when the plugin is at version 1.6.0 or earlier, OTP login is enabled, and Firebase is selected as the verification gateway. The issue affects accounts that have a phone number registered in the plugin's phone table.
What does an attacker need to exploit the bypass?
An attacker does not need to authenticate or interact with a victim. They need to know or guess the target user's registered phone number and submit arbitrary OTP and UID values through the Firebase OTP login flow.
What is the potential impact if an administrator is affected?
An attacker can authenticate as the targeted user, potentially gaining that user's privileges. If an administrator account has a phone number registered in the plugin, this can result in administrator account takeover.