Privilege Escalation Vulnerability in Login with Phone Number Plugin

CVE-2026-110373 identifies an incorrect privilege assignment vulnerability within the 'Login with phone number' WordPress plugin developed by Hamid Alinia. The flaw permits attackers to manipulate authentication or authorization tokens during the login process, resulting in unauthorized privilege escalation. This vulnerability affects all versions of the plugin from its inception up to and including version 1.8.77. The issue is critical for administrators who rely on this plugin for user authentication management, as successful exploitation bypasses standard access control mechanisms defined by the site's user role hierarchy. Defenders should prioritize updating the plugin to the latest version once a security patch is provided by the developer, or monitor for anomalous administrative account creation or role modification events.

Impact

The vulnerability allows for privilege escalation, which could result in full administrative control over the affected WordPress instance. While the number of victims is not explicitly stated, the plugin's function as an authentication handler increases the risk to the integrity and confidentiality of any site using it for user login. If exploited, an attacker could gain elevated rights, leading to data exfiltration, malicious plugin installation, or site defacement.

Recommendation

• Monitor WordPress administrative logs for unauthorized user creation or unexpected escalation of user roles.
• Review all existing accounts on sites running 'Login with phone number' to ensure no unauthorized accounts have been created or assigned administrative privileges.
• Audit plugins regularly for versions known to be vulnerable to CVE-2026-110373 and disable the plugin if a patch is unavailable and the risk is deemed unacceptable.