Authenticated SQL Injection Vulnerability in Login with Phone Number Plugin by WordPress
CVE-2023-23492
8.8HIGH
What is CVE-2023-23492?
The Login with Phone Number WordPress Plugin, specifically versions below 1.4.2, is susceptible to an authenticated SQL injection vulnerability that targets the 'ID' parameter in its 'lwp_forgot_password' action. This issue could allow an attacker with valid credentials to manipulate SQL queries, potentially compromising database integrity and revealing sensitive information. It is critical for users of this plugin to upgrade to the latest version to mitigate risks associated with this vulnerability.
Affected Version(s)
Login with Phone Number WordPress Plugin < 1.4.2
References
EPSS Score
57% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved