{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-115967/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hamid_alinia:login_with_phone_number:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-115967"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Login with phone number (\u003c= 1.8.78)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","authentication-abuse","cve-2026-115967"],"_cs_type":"advisory","_cs_vendors":["Hamid Alinia"],"content_html":"\u003cp\u003eCVE-2026-115967 identifies a weak authentication vulnerability in the Hamid Alinia 'Login with phone number' WordPress plugin. This flaw allows unauthorized actors to perform authentication abuse. The vulnerability is confirmed to affect all versions of the plugin from inception through 1.8.78. No specific remediation version or patch announcement is currently detailed in the vulnerability disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is rated with a CVSS v3.1 base score of 8.8, indicating a high potential for unauthorized access to affected WordPress instances.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress instances to determine if the 'Login with phone number' plugin is installed and running version 1.8.78 or earlier.\u003c/li\u003e\n\u003cli\u003eDisable or remove the plugin until a security patch is provided by the developer.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress authentication logs for suspicious activity or anomalous login attempts involving phone-based authentication workflows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:21:01Z","date_published":"2026-10-29T13:21:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-login-phone-auth/","summary":"The Login with phone number plugin for WordPress is vulnerable to authentication abuse due to weak authentication mechanisms, affecting versions up to and including 1.8.78.","title":"Hamid Alinia Login with phone number: Authentication abuse (CVE-2026-115967)","url":"https://feed.craftedsignal.io/briefs/2026-10-login-phone-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-115967","version":"https://jsonfeed.org/version/1.1"}