CVE-2024-32507
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation. This issue affects Login with phone number: from n/a through 1.7.16.
Risk Assessment
A low-privileged user can escalate to administrative control of the WordPress site, potentially leading to content modification, malicious code installation, or data leakage.
Recommendation
Update the 'Login with phone number' plugin to a version later than 1.7.16. If no update is available, consider disabling the plugin.
Other vulnerabilities in Login with phone number
See all- CVE-2026-115967High
The Login with phone number plugin by Hamid Alinia contains a Weak Authentication vulnerability that allows Authentication Abuse. The issue affects versions from n/a through 1.8.78.
- CVE-2026-110373High
The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-110374Medium
The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-65570High
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS