CVE-2026-110373
8.1HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266
Impact
Unauthenticated remote attackers can escalate privileges on the target WordPress site. They only need network access to the authentication endpoints handled by the plugin.
Root cause
The plugin incorrectly assigns user privileges during the phone-number login process.
Affected systems
WordPress plugin Login with phone number (login-with-phone-number) through version 1.8.77
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the plugin to a version newer than 1.8.77 if available. If no patched release exists yet, deactivate and disable the login-with-phone-number plugin immediately.
$ wp plugin deactivate login-with-phone-numberAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.