The WordPress Login with phone number plugin contains a flaw where privilege levels are not correctly validated during login with phone number authentication. This incorrect privilege assignment allows an attacker to elevate their access rights within the WordPress site. The flaw is classified as CWE‑266, a failure to restrict or control user privileges. If exploited, an attacker may gain administrative control or modify content, compromising confidentiality, integrity, or availability of the site.

The vulnerability affects the Hamid Alinia Login with phone number plugin for WordPress. All versions from the earliest available release up to and including 1.8.77 are impacted. No further version information is provided, but the plugin should be considered vulnerable until at least 1.8.78.

The vulnerability has a CVSS base score of 8.1, indicating a high impact. The EPSS score is not available, so the current exploitation probability is unknown, yet the lack of KEV listing does not reduce the risk in an operational environment. Based on the description, the likely attack vector is that an authenticated or semi‑authenticated user could trigger the flaw using the plugin’s phone‑number login flow; no exploitation code has been disclosed publicly, but a malicious actor could directly manipulate the plugin’s privilege assignment logic to gain elevated rights.