Horizon Alert
Summary of the vulnerability and why it matters
A security flaw in a WordPress plugin that handles phone number and OTP logins could allow unauthorized access to user accounts, including administrator accounts. This vulnerability stems from an issue in how the plugin verifies Firebase sessions, potentially enabling attackers to bypass authentication by submitting a valid Firebase session with a target user's phone number. The main concern is confirming relevance and exposure.
- Plugin allows bypassing login.
- Unauthenticated attackers can impersonate users.
- Verify plugin usage and exposure.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could bypass login protections by exploiting a flaw in how a WordPress phone number login plugin handles Firebase verification. The attacker would initiate a legitimate Firebase session and then submit a request containing the phone number of a target user, including administrators. Because the plugin does not properly link the Firebase session to the provided phone number, the attacker can gain authenticated access as the targeted user.
- Entry: No user authentication required.
- Trigger: Sending a forged request during verification.
- Risk: Complete account takeover and unauthorized access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to bypass authentication and access any user account, including administrator accounts, on a WordPress site when the "OTP Login With Phone Number, OTP Verification" plugin is in use. This is possible because the plugin's Firebase verification flow does not properly link a verified Firebase session to the phone number provided in a request.
- User accounts and administrative access.
- Authentication bypass via Firebase session manipulation.
- Unauthorized access and control of website functions.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in an authentication plugin for WordPress requires immediate attention from the platform or infrastructure team responsible for managing the WordPress environment. The first step is to identify all instances of the affected plugin, determine their exposure to the internet, and confirm which systems are business-critical. Subsequently, the accountable owner for each identified instance must be located to coordinate remediation efforts, prioritizing those with the greatest risk.
- Platform or Infrastructure teams should own this.
- Verify internet-facing WordPress instances.
- Plan and execute remediation based on risk.
