Digits CVE-2026-28165

The affected component is the Digits plugin's authentication flow (OTP/phone-based login and registration); the site must have Digits ≤ 9.2 installed and active with its login/registration functionality reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special access are required, so exploitation works against default-exposed installations. The main limiting factors are simply having the plugin installed at a vulnerable version and its endpoints being publicly accessible; the precise sub-feature or configuration that triggers the privilege assignment is not detailed in the available data.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact - a textbook critical priority for any exposed WordPress site running Digits. However, the corroborating exploitation signals are thin: there is no EPSS score, no KEV listing, and no POC provided, so the 9.8 reflects potential severity rather than confirmed real-world exploitation. The single Patchstack reference confirms the vulnerability class and version ceiling but does not include technical detail on the exact privileged action reachable, so the precise attack path is INFERRED from CWE-266 plus the vector, not confirmed. Net: treat as high-priority to patch given trivial exploitability and full impact, while recognizing exploitation is not yet observed in the wild.

An attacker sends a crafted request directly to the Digits registration or OTP-verification endpoint of a public WordPress site and, exploiting the incorrect privilege assignment, provisions or elevates an account to an administrative role without valid credentials. Because no authentication or user interaction is required (PR:N/UI:N), this can be done remotely against any reachable vulnerable site; no public exploit code has been identified at time of analysis.