What the vulnerability does
01Description
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
Explanation of Vulnerability in Simple Terms
02Summary
Classified Listing - Mobile Number Verification versions up to 1.6.0 contain an authentication bypass vulnerability. An attacker can bypass authentication checks using alternate names or identifiers, gaining unauthorized access to the system. This affects confidentiality, integrity, and availability of the application. Update to a version newer than 1.6.0 to remediate.
What an attacker can do
03Attacker Capabilities
Bypass authentication and gain unauthorized access to the application without valid credentials.
Potential impact on your site
04Site Impact
Unauthorized users can access sensitive data, modify content, or disrupt service availability.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 26, 2026
CVE published
