Introduction
Attackers can bypass OTP verification and gain administrative access to WordPress sites running WooCommerce OTP Login With Phone Number, OTP Verification plugin up to version 1.8.47. On e-commerce sites that rely on this plugin for two-factor authentication, attackers can compromise user accounts and the integrity of the site.
WooCommerce OTP Login With Phone Number, OTP Verification is a widely used WordPress plugin that adds phone-based authentication to thousands of online stores. It uses Firebase to deliver OTPs, which is meant to strengthen account security, but flaws in the implementation have caused repeated vulnerabilities.
Technical Information
CVE-2025-8342 comes from insufficient empty-value checking in the lwp_ajax_register function. When it handles registration or authentication requests, the plugin does not adequately check that the required OTP parameters are present and correctly formatted. The problem appears when the Firebase API key is missing or not configured, because the plugin's error handling for Firebase API responses is flawed. Instead of treating an API error as an authentication failure, the function may read certain error conditions as a successful OTP verification.
An unauthenticated attacker can therefore send crafted requests to the vulnerable AJAX endpoint (admin-ajax.php) with empty or malformed OTP values. The plugin then skips OTP verification and grants access to user accounts associated with a configured phone number. The vulnerability is classified as CWE-862 (Missing Authorization).
Relevant code references:
No public proof-of-concept code is available, but manipulating the POST parameters sent to the AJAX endpoint can trigger the vulnerability.
Affected Systems and Versions
- Product: WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress
- Affected versions: All versions up to and including 1.8.47
- Vulnerable configuration: Sites with the plugin installed and Firebase API key missing or not configured
Vendor Security History
The plugin has a documented history of authentication-related vulnerabilities, including:
- CVE-2024-5150: Authentication bypass in the same
lwp_ajax_registerfunction - Multiple vulnerabilities tracked in the WPScan plugin history
The vendor usually releases patches quickly, but the same kinds of issues keep recurring in similar code paths, which suggests its security review and testing need improvement.
