Login with Phone Number EUVD-2026-102253

Exploitation requires an existing authenticated account on the target WordPress site (CVSS PR:L), so the attacker must be a registered/logged-in user rather than an anonymous visitor - this is the primary limiting factor. The flaw stems from incorrectly configured access control on the 'Login with phone number' plugin at versions up to and including 1.8.77; the exact protected action or endpoint is not specified in the advisory. No user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). Impact is limited to integrity (I:L) with no confidentiality or availability effect, and scope is unchanged, so the unauthorized action is bounded to the plugin/application context. The site must have this plugin installed and active in an affected version.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WordPress plugin 'Login with phone number' (through 1.8.77), scored CVSS 4.3 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vector indicates network-reachable, low-complexity exploitation requiring low-level privileges (PR:L, i.e. an authenticated account) with no user interaction, but limited to a low integrity impact and no confidentiality or availability impact - consistent with a broken access control issue where an under-privileged user can perform an action gated behind incorrectly configured access controls. Signals are mostly aligned and point to a modest priority: no CISA KEV listing (not confirmed actively exploited), no public exploit code identified, and no EPSS score was provided in the input to estimate exploitation probability. No SSVC decision data was supplied. The single confirming source is a Patchstack advisory. Overall this reads as a genuine but low-to-moderate access-control weakness rather than a widespread-exploitation emergency; the requirement for an existing authenticated account and the integrity-only, scope-unchanged impact meaningfully cap real-world risk. EPSS and KEV data being absent means exploitation likelihood cannot be quantified from the input.

An attacker who already holds a low-privilege authenticated account (e.g., a subscriber or registered user on a WordPress site running this plugin) sends a crafted request to a plugin endpoint that fails to properly verify authorization, performing an action or modifying data they should not be permitted to. Because the access control is incorrectly configured rather than merely weak, the action succeeds without elevated privileges, yielding a limited integrity impact. No public exploit code was identified at time of analysis.