Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Login with Phone Number plugin lets attackers become admins

CVE-2026-110373 · published today
Summary

Versions of the WordPress "Login with Phone Number" plugin up to 1.8.77 let a user who logs in with a phone number gain full administrator rights on the site. This could allow them to change settings, add or remove content, and potentially take control of the whole site. Update the plugin to the latest version immediately, or disable/remove it if you do not need phone‑based logins.

What to do
  • Update hamid alinia login with phone number to version 1.8.78.
Affected software
VendorProductAffected versions
hamid alinia login with phone number <= 1.8.77
Fix: upgrade to 1.8.78
Original advisory text
WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-110373 · NVD
CVE-2026-110373 · MITRE
Track software like this
Free during beta