CVE-2024-32832
BaseFortify
Publication date: 2025-08-31
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | login_with_phone_number | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization (Broken Access Control) flaw in the WordPress plugin "Login with Phone Number" up to version 1.6.93. It allows unauthenticated users to perform actions that should be restricted to higher-privileged users because the plugin lacks proper authorization, authentication, or nonce token checks. This means attackers can bypass security controls and potentially take over or manipulate the site. [1]
How can this vulnerability impact me? :
The vulnerability has a critical impact with a CVSS score of 9.8. It can allow attackers to gain unauthorized access and perform high-impact actions such as compromising confidentiality, integrity, and availability of the affected system. This can lead to site takeover, data breaches, and service disruption. The vulnerability is actively exploited in the wild and expected to see mass exploitation, making it urgent to update the plugin to version 1.6.94 or later. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or detailed methods to detect this vulnerability on your network or system. Detection would likely involve monitoring for unauthorized access attempts or checking the plugin version installed, but no explicit detection commands are given.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WordPress plugin "Login with Phone Number" to version 1.6.94 or later, which contains the fix for this vulnerability. Alternatively, applying the Patchstack virtual patch (vPatch) can automatically block attacks until the update is performed. It is also recommended to perform professional incident response and server-side malware scanning if compromise is suspected. [1]