Cross-Site Request Forgery Vulnerability in Login with Phone Number Plugin by WordPress

CVE-2023-4916

What is CVE-2023-4916?

The Login with Phone Number plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the 'lwp_update_password_action' function. This flaw allows unauthenticated adversaries to potentially alter user passwords through a forged request, requiring only that the attacker deceives an admin into clicking a malicious link, thus exposing user credentials to unauthorized access.

References