CVE-2026-110374
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could gain access to functions or data they are not authorized to use, potentially leading to unauthorized actions on the site.
Recommendation
Update the 'Login with phone number' plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Login with phone number
See all- CVE-2026-115967High
The Login with phone number plugin by Hamid Alinia contains a Weak Authentication vulnerability that allows Authentication Abuse. The issue affects versions from n/a through 1.8.78.
- CVE-2026-110373High
The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-65570High
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
- CVE-2024-32507High
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation. This issue affects Login with phone number: from n/a through 1.7.16.
Original NVD description (English source)
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS