Missing authorization in the WordPress Login with Phone Number plugin allows attackers to bypass proper access controls due to incorrect configuration, leading to unauthorized access or privilege escalation. This flaw is a classic example of missing authorization (CWE-862) that can expose user data or allow attackers to perform actions intended for authenticated users.

WordPress sites that installed Hamid Alinia’s Login with Phone Number plugin version 1.8.77 or earlier are affected. The vulnerability applies to all installations of the plugin that use the default or a custom configuration within the specified version range.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw via the plugin’s web interface, gaining unauthorized privileges on a site that has the plugin misconfigured, but no known active exploits are reported. The risk remains moderate and warrants remediation.