CVE-2026-110374: WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Login with phone numberto a version that resolves this vulnerability.Fixed in 1.8.78
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges (PR:L). It does not require user interaction and can be exploited over the network.
What is the potential impact if exploitation succeeds?
The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated by the provided CVSS vector.
Which plugin versions are affected?
Login with Phone Number versions through 1.8.77 are affected. The earliest affected version is not specified.