Description

Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T15:17:18.433Z",
  "pubdate": "2026-08-06T15:17:18.433Z",
  "executiveSummary": "An unauthenticated authentication bypass vulnerability has been identified in the Login with phone number plugin affecting versions 1.8.70 and below.\nThis security flaw allows remote, unauthenticated attackers to completely bypass standard authentication mechanisms and gain unauthorized access to target systems.\nThe vulnerability exposes affected WordPress sites and web applications to severe risk, potentially leading to unauthorized privilege escalation, account takeover, and complete compromise of user data and session integrity.\nAttackers require no prior privileges or valid credentials to exploit this vulnerability, relying solely on network exposure to interact with the vulnerable authentication component.\nSuccessful exploitation requires the target to run vulnerable versions of the specified plugin without adequate security controls or compensating boundary defenses.",
  "technicalDetails": "The vulnerability resides within the authentication handling logic of the Login with phone number plugin, specifically in versions <= 1.8.70, where input validation or session initialization flaws allow requests to bypass credential verification checks.\nThe root cause stems from improper handling of authentication tokens, weak cryptographic verification, or flawed conditional logic that assumes incoming requests have been pre-authenticated when specific parameters are supplied.\nNetwork exposure is direct, as the vulnerable component exposes HTTP endpoints accessible to any unauthenticated remote user over standard network protocols.\nThe attack flow proceeds as follows: First, the adversary sends a crafted HTTP request directly to the vulnerable authentication endpoint associated with the plugin.\nSecond, due to insufficient validation of request parameters and lack of strict state verification within the plugin codebase, the application fails to enforce mandatory credential checks.\nThird, the vulnerable component erroneously instantiates an authenticated session for the attacker or targeted user account without requiring valid proof of identity such as a password or verified SMS OTP code.\nPost-exploitation impact includes full account takeover, unauthorized access to sensitive user data, and potential lateral movement if the compromised account possesses administrative privileges within the application.\nNo authentication or privilege requirements are needed to initiate the attack sequence, making this a critical vector for automated exploitation campaigns."
}