Login with Phone EUVD-2026-103432

The flaw affects the Login with phone number WordPress plugin (by Hamid Alinia) in all versions up to and including 1.8.77, so a vulnerable deployment requires that plugin to be installed and active. The CVSS vector marks PR:N/UI:N (no authentication or user interaction) but AC:H, meaning exploitation hinges on conditions the attacker does not control - likely specific timing, a race, or a particular account/registration state in the phone-based login flow - rather than a single deterministic request. The input provides no further mechanism detail, so the exact feature/configuration trigger is not verifiable from available data; the AC:H requirement is the primary factor limiting reliable real-world exploitation, and defenders should confirm specifics against the Patchstack advisory and upgrade past 1.8.77.

This is a serious-on-paper flaw with meaningful caveats. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated (PR:N) privilege-escalation issue (CWE-266, Incorrect Privilege Assignment) with full confidentiality, integrity, and availability impact - consistent with an attacker gaining administrative-level access to a WordPress site. The single tempering signal in the vector itself is AC:H, meaning exploitation requires conditions outside the attacker's control (e.g., winning a race, specific timing, or a particular account/state), which lowers reliability of exploitation. No EPSS probability, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.1 is a theoretical severity rating from the reporter (Patchstack), not an observed-exploitation signal. Net: treat as a high-priority patch for any site running this plugin because privilege escalation on WordPress is directly weaponizable, but the AC:H requirement and absence of EPSS/KEV/POC suggest it is not (yet) a mass-exploitation event. Note a data gap: the vector claims PR:N/UI:N (fully unauthenticated, no interaction), yet the Patchstack summary gives no mechanism, so the true preconditions behind AC:H cannot be verified from the available data and should be confirmed with the vendor/Patchstack advisory.

An attacker who can reach the login/phone-authentication endpoints of a WordPress site running Login with phone number ≤ 1.8.77 abuses the plugin's incorrect privilege assignment to obtain an account with elevated (administrator-level) capabilities without prior authentication. Because success depends on specific conditions (CVSS AC:H), the attacker may need to meet particular timing or account-state requirements rather than firing a single reliable request. No public proof-of-concept was identified at time of analysis.