Authentication Bypass Vulnerability in Login with Phone Number Plugin for WordPress

CVE-2024-5150

What is CVE-2024-5150?

The Login with Phone Number plugin for WordPress contains a vulnerability that allows for authentication bypass in versions 1.7.26 and earlier. This issue arises because the 'activation_code' parameter's default value is set to empty, and the validation check for a non-empty activation code is absent in the 'lwp_ajax_register' function. Consequently, this flaw enables unauthenticated attackers to gain unauthorized access to the site as any existing user, including administrators, provided they have access to the user's email address. Although version 1.7.26 addresses some aspects of this vulnerability, it introduces a flaw that renders the entire login function non-operational. The problem is resolved in version 1.7.27.

References