GCVE - cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Idehweb (`0a33c421-5220-5a46-a5d1-802dbbdb629b`)
Product	Login With Phone Number (`6a6d7560-f4bb-5e6b-8416-c3573773cf0e`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-6482`	vulnerable	2026-06-08 06:58:19.568754	Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation HIGH (8.8) The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49. Published: 2024-09-14T12:31:08.795Z Updated: 2026-04-08T17:28:19.666Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=cve https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php#L3803 https://plugins.trac.wordpress.org/changeset/3129185/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37429`	vulnerable	2026-06-08 06:39:47.554479	WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability MEDIUM (5.9) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.35. Published: 2024-07-22T08:26:56.544Z Updated: 2026-04-28T16:09:58.627Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-7-35-admin-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-31424`	vulnerable	2026-06-08 06:35:31.509960	WordPress Login with Phone Number plugin <= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability HIGH (8.8) Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93. Published: 2024-04-15T10:07:10.451Z Updated: 2026-04-28T16:09:32.208Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-6-93-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-4916`	vulnerable	2026-06-08 06:16:14.902827	Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change HIGH (8.8) The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2023-09-13T02:54:11.877Z Updated: 2026-04-08T17:00:30.115Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/71083db7-377b-47a1-ac8b-83d8974a2654?source=cve https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2965324#L2942 https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2967707#L2948	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23492`	vulnerable	2026-06-08 05:56:02.782747	Details available The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. Published: 2023-01-20T00:00:00.000Z Updated: 2025-04-03T20:07:48.525Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2023-3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0598`	vulnerable	2026-06-08 05:39:10.360218	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-0593`	vulnerable	2026-06-08 05:39:10.353847	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Login With Phone Number

Notes

PURL mappings

Vulnerability references

Contribute