CVE-2026-115967
HighCVSS 8.8Summary
The Login with phone number plugin by Hamid Alinia contains a Weak Authentication vulnerability that allows Authentication Abuse. The issue affects versions from n/a through 1.8.78.
Risk Assessment
An attacker can bypass the authentication mechanism and gain access to accounts or features protected by login, potentially leading to unauthorized access to the site.
Recommendation
Update the Login with phone number plugin to a version newer than 1.8.78. If no fix is available, consider disabling the plugin.
Other vulnerabilities in Login with phone number
See all- CVE-2026-110373High
The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-110374Medium
The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-65570High
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
- CVE-2024-32507High
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation. This issue affects Login with phone number: from n/a through 1.7.16.
Original NVD description (English source)
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS