CVE-2026-65570
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Unauthenticated Bypass Vulnerability in Login with phone number versions up to 1.8.70.
Risk Assessment
An attacker can bypass authentication mechanisms and gain unauthorized access to user accounts.
Recommendation
Update the Login with phone number plugin to the latest available version that includes the fix.
Other vulnerabilities in Login with phone number
See all- CVE-2026-115967High
The Login with phone number plugin by Hamid Alinia contains a Weak Authentication vulnerability that allows Authentication Abuse. The issue affects versions from n/a through 1.8.78.
- CVE-2026-110373High
The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-110374Medium
The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2024-32507High
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation. This issue affects Login with phone number: from n/a through 1.7.16.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS