Login with phone number WordPress plugin: Privilege escalation
Summary
The WordPress plugin Login with phone number up to and including version 1.8.77 contains a privilege escalation flaw classified as incorrect privilege assignment. According to the Patchstack advisory, a low-privilege user can become an administrator and gain full control of the website. The CVSS 3.1 base score is 8.1 with a high attack complexity; Patchstack lists the required privilege as unauthenticated. Public sources report no known exploitation at the time of writing.
Affected
- Login with phone number WordPress plugin, versions up to and including 1.8.77
- Versions before 1.8.78 are treated as affected according to the CNA version data
Fixed in
- Version 1.8.78 (first unaffected version according to CNA and Patchstack)
- Newer releases should be installed as well; one unverified aggregator reports a later fix in 1.8.79
Workaround
- No vendor workaround known.
- If an update cannot be applied immediately, temporarily disable the plugin or its phone-login feature (own recommendation, not from the vendor).
Exploitation
- Not marked as known exploited by the sources checked.
- Patchstack rates the vulnerability as high priority and expects exploitation; CISA SSVC lists exploitation as none and automatable as no.
- No public proof of concept found.
Our recommendation
- Inventory all WordPress sites with this plugin, including staging and client sites.
- Update to version 1.8.78 or later, preferably the newest release available on WordPress.org or GitHub.
- Check for unexpected administrator accounts and recent role changes.
- Review WordPress and server logs for unusual logins or role updates since mid-October 2026.
- Monitor NVD and Patchstack for updates to this record.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- CVE record mirror (CNA data) vulners.com
- Vendor release 1.8.78 github.com
- Plugin changelog github.com
- Exploitation status summary hol.org
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:48.
Original description (NVD)
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.