CVE-2026-110373
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
Risk Assessment
This allows an attacker to escalate privileges and take control of the site or system. It can lead to full site compromise.
Recommendation
Update the Login with phone number plugin to the latest version that fixes this vulnerability. Check for any unauthorized changes in user privileges.
Other vulnerabilities in Login with phone number
See all- CVE-2026-115967High
The Login with phone number plugin by Hamid Alinia contains a Weak Authentication vulnerability that allows Authentication Abuse. The issue affects versions from n/a through 1.8.78.
- CVE-2026-110374Medium
The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-65570High
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
- CVE-2024-32507High
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation. This issue affects Login with phone number: from n/a through 1.7.16.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS