WordPress CVEs

Description

The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.

Affected WordPress components

• OTP Login With Phone Number, OTP Verification Plugin · login-with-phone-number
  Confirmed match Active
  Up to and including 1.7.26
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• glboy OTP Login With Phone Number, OTP Verification — Up to and including 1.7.26

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4183
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4220
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.7.25/login-with-phonenumber.php#L4241
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3090625/login-with-phone-number
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3090754/login-with-phone-number#file5
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/cf34eb9f-f6e9-4a7a-8459-c86f9fa3dad8?source=cve
• nvd.nist.gov Official NVD record