CVE-2026-15985 in Classified Listing Plugin
Summary
by MITRE • 08/26/2026
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within The Classified Listing - Mobile Number Verification plugin for WordPress represents a critical authentication bypass flaw affecting all versions up through 1.6.0. This security defect stems from a fundamental failure in server-side validation logic, specifically within the process_otp_login function which handles One-Time Password verification via Firebase. In a secure implementation of two-factor or multi-step authentication using external identity providers like Firebase, the backend must rigorously verify that the OTP code and user identifier submitted by the client match those issued by the trusted third-party service. However, in this instance, the plugin fails to perform any server-side validation against Firebase's API to confirm the authenticity of the provided credentials. This architectural oversight effectively nullifies the security controls intended to restrict access based on verified phone numbers, allowing the authentication mechanism to be circumvented entirely under specific conditions.
From a technical perspective, an unauthenticated attacker can exploit this flaw by interacting directly with the plugin’s login endpoint and submitting arbitrary values for both the OTP code and the unique identifier associated with Firebase sessions. Because the server does not cross-reference these inputs with Firebase's records of valid, issued tokens, it accepts any combination that fits the expected data structure as a successful authentication event. This behavior constitutes an Authentication Bypass vulnerability where the system trusts client-supplied assertions without independent verification from the authoritative source. The operational impact is severe, as this flaw allows attackers to assume the identity of any user who has registered their mobile number with the plugin. If the targeted account possesses administrative privileges and a linked phone number, the attacker gains full control over the WordPress installation, potentially leading to complete site compromise, data exfiltration, or further lateral movement within the network infrastructure hosting the application.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically highlighting failures in verifying credentials against an authoritative source. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as well as T1651, Cloud Infrastructure Discovery and Access, given the reliance on Firebase services for identity management. The exploitation requires that OTP login be enabled with Firebase selected as the verification gateway and necessitates that the attacker knows or can guess the target’s registered phone number to construct a valid request payload targeting their specific account identifier. This prerequisite limits the blast radius slightly compared to fully blind attacks but still poses a significant risk in environments where user data may be exposed through other vectors such as public profiles, directory listings, or previous data breaches.
To mitigate this vulnerability and restore secure authentication practices, immediate action is required by site administrators. The most effective remediation strategy involves upgrading the plugin to version 1.6.1 or later, where the developers have presumably implemented proper server-side validation against Firebase’s API endpoints before granting access. Until an update can be applied, temporary mitigation strategies should include disabling the mobile number verification feature entirely if it is not strictly necessary for business operations, thereby removing the vulnerable code path from execution. Additionally, implementing a Web Application Firewall rule to monitor and restrict unusual patterns of login attempts targeting OTP endpoints may help detect exploitation in progress. It is also advisable to enforce strong password policies and enable additional layers of authentication that do not rely solely on this specific plugin’s implementation for critical administrative accounts, ensuring that even if one vector is compromised, the overall security posture remains resilient against unauthorized access.