Login with Phone Number CVE-2026-65570

Update the Login with Phone Number plugin immediately to a version above 1.8.70 once a patched release is confirmed available in the WordPress plugin repository - no specific fixed version number was provided in the available intelligence, so administrators should monitor the plugin's changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-8-70-bypass-vulnerability-vulnerability for confirmation of a fix. As an interim compensating control, deactivating or removing the plugin and reverting to WordPress's native password-based login eliminates the attack surface entirely, at the trade-off of disrupting phone-number-based login for users. If deactivation is not operationally feasible, restricting the WordPress login endpoint (wp-login.php) to trusted IP ranges via web server rules or a WAF rule targeting the phone-login flow reduces remote exploitability, though it does not eliminate the underlying flaw. Enabling multi-factor authentication on high-privilege accounts via a separate plugin provides defense-in-depth if the plugin must remain active.