{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/hamid-alinia/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hamidalinia:login_with_phone_number:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110373"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Login with phone number (\u003c= 1.8.77)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Hamid Alinia"],"content_html":"\u003cp\u003eCVE-2026-110373 identifies an incorrect privilege assignment vulnerability within the 'Login with phone number' WordPress plugin developed by Hamid Alinia. The flaw permits attackers to manipulate authentication or authorization tokens during the login process, resulting in unauthorized privilege escalation. This vulnerability affects all versions of the plugin from its inception up to and including version 1.8.77. The issue is critical for administrators who rely on this plugin for user authentication management, as successful exploitation bypasses standard access control mechanisms defined by the site's user role hierarchy. Defenders should prioritize updating the plugin to the latest version once a security patch is provided by the developer, or monitor for anomalous administrative account creation or role modification events.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for privilege escalation, which could result in full administrative control over the affected WordPress instance. While the number of victims is not explicitly stated, the plugin's function as an authentication handler increases the risk to the integrity and confidentiality of any site using it for user login. If exploited, an attacker could gain elevated rights, leading to data exfiltration, malicious plugin installation, or site defacement.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor WordPress administrative logs for unauthorized user creation or unexpected escalation of user roles.\u003c/li\u003e\n\u003cli\u003eReview all existing accounts on sites running 'Login with phone number' to ensure no unauthorized accounts have been created or assigned administrative privileges.\u003c/li\u003e\n\u003cli\u003eAudit plugins regularly for versions known to be vulnerable to CVE-2026-110373 and disable the plugin if a patch is unavailable and the risk is deemed unacceptable.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T11:57:33Z","date_published":"2026-10-18T11:57:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110373/","summary":"The Login with phone number plugin by Hamid Alinia contains an incorrect privilege assignment vulnerability, CVE-2026-110373, which enables unauthenticated or low-privileged users to escalate their access levels.","title":"Privilege Escalation Vulnerability in Login with Phone Number Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110373/"}],"language":"en","title":"CraftedSignal Threat Feed - Hamid Alinia","version":"https://jsonfeed.org/version/1.1"}