CVE-2025-8342CWE-862

WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass

High · published August 15, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-08-15T02:24Z
EPSS history
Timeline
  • 15 AUG 02:24Z
    WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass
    cvelistv5