Unauthorized Password Resets in Login with Phone Number Plugin for WordPress

CVE-2024-6125

What is CVE-2024-6125?

The Login with Phone Number plugin for WordPress contains a vulnerability that allows unauthorized password resets in its versions up to 1.7.34. This issue arises from the generation of weak reset codes that are too simplistic, making it feasible for attackers to guess a 6-digit numeric code. Additionally, the absence of any limitation on attempts or timeframes for using the reset code further amplifies this risk. As a result, unauthenticated users could potentially reset the passwords of any arbitrary user. Website owners using this plugin are advised to update to the latest version to mitigate these security risks.

References