CSRF Vulnerability in Hamid Alinia - idehweb Login with Phone Number
CVE-2024-31424

8.8HIGH

Key Information:

Vendor

WordPress
Status
Login With Phone Number
Vendor
CVE Published:
15 April 2024

What is CVE-2024-31424?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Login with Phone Number plugin developed by Hamid Alinia. This flaw allows an attacker to potentially trick a logged-in user into executing unwanted actions on the WordPress site. If exploited, this security issue can compromise the security of user accounts, leading to unauthorized access and manipulation of user data. The vulnerability affects versions released from n/a through 1.6.93, highlighting the importance of maintaining up-to-date plugins to safeguard against such attacks.

Affected Version(s)

Login with phone number 0 <= 1.6.93

References

https://patchstack.com/database/Wordpress/Plugin/login-wi...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Majed Refaea (Patchstack Alliance)
.