Missing Authorization Vulnerability in Login with Phone Number Plugin by Hamid Alinia
CVE-2026-110374

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Login With Phone Number
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110374?

A missing authorization vulnerability exists in the Login with Phone Number plugin developed by Hamid Alinia, which could potentially allow unauthorized users to exploit incorrectly configured access controls. This issue specifically affects versions of the plugin from n/a through 1.8.77, enabling unauthorized access to sensitive functionality and user data. Website administrators should ensure proper configuration and updates to maintain security.

Affected Version(s)

Login with phone number 0 <= 1.8.77

References

https://patchstack.com/database/wordpress/plugin/login-wi...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

myhappyhoon | Patchstack Bug Bounty Program
.