CVE-2026-15985

Name of the Vulnerable Software and Affected Versions Classified Listing - Mobile Number Verification versions prior to 1.6.1

Description An authentication bypass exists due to missing server-side Firebase OTP validation within the process otp login() function. This allows unauthenticated attackers to authenticate as any user registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Exploitation is possible if OTP login is enabled with Firebase as the verification gateway and the attacker knows or guesses the target account's registered phone number. This can lead to the takeover of administrator accounts if they have a registered phone number.

Recommendations Update to a version newer than 1.6.0. As a temporary mitigation, disable OTP login or switch the verification gateway from Firebase to another provider.