Vendor
The Login with phone number plugin by Hamid Alinia contains an incorrect privilege assignment vulnerability, CVE-2026-110373, which enables unauthenticated or low-privileged users to escalate their access levels.