CVE-2026-15985: CWE-289 Authentication Bypass by Alternate Name in RadiusTheme Classified Listing - Mobile Number Verification

CVE-2026-15985 is an authentication bypass vulnerability in the Classified Listing - Mobile Number Verification WordPress plugin by RadiusTheme. The vulnerability exists because the process_otp_login() function does not perform server-side validation of Firebase OTPs, enabling attackers to bypass authentication by submitting arbitrary OTP codes and user IDs. This affects all plugin versions up to and including 1.6.0. Successful exploitation requires that OTP login is enabled with Firebase as the verification gateway and that the attacker knows or can guess the phone number registered to the target account. Administrator accounts with registered phone numbers are susceptible to takeover through this flaw. The vulnerability is tracked under CWE-289 (Authentication Bypass).

An attacker can bypass authentication and impersonate any user with a registered phone number in the plugin's phone table by submitting arbitrary OTP codes and user IDs. This includes the potential takeover of administrator accounts if their phone numbers are registered, leading to full compromise of the WordPress site. The vulnerability affects confidentiality, integrity, and availability of the affected system.

A patch is available for this vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory for confirmation of patch deployment. Until patched, disabling OTP login or Firebase as the verification gateway can mitigate the risk. No other specific mitigations are documented.