PT-2025-33428 · WordPress · Woocommerce Otp Login With Phone Number

Arkadiusz Hydzik · Published 2025-08-15 · Updated 2025-08-20 · CVE-2025-8342

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress versions up to and including 1.8.47

Description: The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is susceptible to authentication bypass due to inadequate empty value checking within the lwp ajax register function. This allows unauthenticated attackers to circumvent OTP verification and potentially gain administrative access to user accounts with a configured phone number. The issue arises from improper Firebase API error handling when the Firebase API key is not configured.

Recommendations: Update the WooCommerce OTP Login With Phone Number, OTP Verification plugin to a version later than 1.8.47.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-8342

Affected Products

Woocommerce Otp Login With Phone Number

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8342 · Security Note
• https://twitter.com/cracbot/status/1958121884655947859 · Twitter Post
• https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4373 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6e74582f-8e94-4cba-a3eb-0a823a5235ad?source=cve · Note
• https://t.me/CVEtracker/30075 · Telegram Post
• https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4358 · Note
• https://twitter.com/CVEnew/status/1956289047338606913 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338150%40login-with-phone-number&new=3338150%40login-with-phone-number&sfp_email=&sfph_mail= · Note