Incorrect Privilege Assignment in Login with Phone Number Allows Privilege Escalation

Executive Summary

This is a privilege escalation vulnerability in the WordPress plugin 'Login with phone number' versions 1.8.77 and earlier. It allows low-privilege users to gain administrator-level access, taking full control of the website. The flaw is due to incorrect privilege assignment in the plugin.

Useful 0 Not Useful 0

Detection Guidance

Check if the Login with phone number plugin version is 1.8.77 or earlier. Use WordPress admin panel to view plugin versions or run a command like 'wp plugin list' in the WordPress directory to list installed plugins and their versions.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to gain full control of your website, allowing them to modify content, steal data, install malware, or take the site offline. Mass campaigns targeting thousands of websites are possible, making this a high-risk issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privilege users to escalate privileges to administrator level, potentially granting unauthorized access to sensitive data. Such unauthorized access could lead to violations of GDPR (General Data Protection Regulation) due to improper handling of personal data and HIPAA (Health Insurance Portability and Accountability Act) if protected health information is exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Login with phone number plugin to version 1.8.78 or later immediately. If updating is not possible, apply Patchstack's automatic mitigation rule to block attacks until the plugin is updated. Contact your hosting provider or web developer for assistance if needed.

Useful 0 Not Useful 0