{"id":"CVE-2026-110373","kind":"vulnerability","aliases":["CVE-2026-110373"],"related":[],"title":"Login with phone number WordPress plugin: incorrect privilege assignment lets users escalate","description":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.","summary":"The Login with phone number plugin for WordPress, by Hamid Alinia, assigns privileges incorrectly, so a user can gain higher access than intended. An attacker who can register or log in gets elevated rights on the site.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version under Plugins in the WordPress admin, or `wp plugin get login-with-phone-number --field=version` with WP-CLI\n- Review the list of administrator accounts for unexpected users","fix":"- Update Login with phone number to a version later than `1.8.77`, if the vendor has released one (unknown from the sources)\n- If no fixed version exists, deactivate the plugin until one is published","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:06:36+00:00","updated_at":"2026-10-25T03:06:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:06:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Login with phone number to a version later than `1.8.77`, if the vendor has released one (unknown from the sources)\n- If no fixed version exists, deactivate the plugin until one is published","reach":"internet","title":"Login with phone number WordPress plugin: incorrect privilege assignment lets users escalate","impact":"high","summary":"The Login with phone number plugin for WordPress, by Hamid Alinia, assigns privileges incorrectly, so a user can gain higher access than intended. An attacker who can register or log in gets elevated rights on the site.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains elevated site privileges, possibly administrator access","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact vulnerable role or endpoint; the sources only say 'from n/a through 1.8.77'.","how_to_check":"- Check the installed plugin version under Plugins in the WordPress admin, or `wp plugin get login-with-phone-number --field=version` with WP-CLI\n- Review the list of administrator accounts for unexpected users","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Login with phone number plugin at version `1.8.77` or earlier are affected. The sources do not say which login or registration paths are required to trigger it, so treat any site with the plugin active as exposed. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000618,"input_tokens":3299,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110373':15A,18A '-2026':14A,17A '1.8.77':89C 'access':44B 'affect':81C 'alinia':34B,67C 'allow':77C 'assign':9A,35B,63C 'attack':48B 'cve':13A,16A 'elev':56B 'escal':12A 'escalation.this':79C 'gain':42B 'get':55B 'hamid':33B,66C 'higher':43B 'host':22B 'incorrect':7A,37B,61C 'intend':46B 'issu':80C 'let':10A 'log':53B 'login':1A,25B,68C,73C,82C 'login-with-phone-numb':72C 'n/a':87C 'number':4A,28B,71C,76C,85C 'packag':19B 'phone':3A,27B,70C,75C,84C 'plugin':6A,29B 'privileg':8A,36B,62C,78C 'regist':51B 'right':57B 'self':21B 'self-host':20B 'site':60B 'user':11A,40B 'vulner':64C 'wordpress':5A,23B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Login with phone number plugin at version `1.8.77` or earlier are affected. The sources do not say which login or registration paths are required to trigger it, so treat any site with the plugin active as exposed. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110373","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T19:17:20+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}