The OTP Login With Phone Number plugin for WordPress contains an authentication bypass vulnerability in versions 1.8.50 through 1.8.60. The flaw exists in the Firebase verification flow where the lwp_ajax_register AJAX handler fails to properly bind Firebase sessions to phone numbers. The idehweb_lwp_activate_through_firebase() function validates Firebase OTP sessions but never compares the returned phoneNumber against the victim's stored phone number. This allows unauthenticated attackers to authenticate as any user with a stored phone number, including administrators, by verifying their own Firebase session while supplying the victim's phone number in the request.