CVE-2024-6482: Idehweb Login With Phone Number Privilege Escalation

CVE-2024-6482 Overview

The Login with Phone Number plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 1.7.49. The flaw resides in the lwp_update_password_action function, which lacks input validation and a proper capability check on user-supplied data. Authenticated attackers with Subscriber-level access or above can update their own role to any role available on the site, including Administrator. The vendor partially patched the issue in version 1.7.40, after which exploitation required the companion Login with Phone Number Pro plugin. The vulnerability is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Any authenticated subscriber can escalate to Administrator, resulting in full compromise of the affected WordPress site.

Affected Products

Idehweb Login with Phone Number for WordPress, versions up to and including 1.7.49
Idehweb Login with Phone Number Pro (required for exploitation in versions 1.7.40 – 1.7.49)
WordPress sites running any vulnerable release of the login-with-phone-number plugin

Discovery Timeline

2024-09-14 - CVE-2024-6482 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6482

Vulnerability Analysis

The vulnerability is a broken access control flaw in the plugin's password update handler. The lwp_update_password_action function processes AJAX requests intended to let users change their password. Because the function accepts arbitrary user-supplied fields and does not verify the caller's capability to modify sensitive user metadata, an authenticated attacker can send additional parameters that overwrite the target account's wp_capabilities value. The plugin trusts the request payload rather than restricting updates to password-related fields. Exploitation requires only Subscriber-level authentication, which is the lowest privileged tier and is often obtainable through open registration.

Root Cause

The root cause is a missing capability check combined with insufficient input validation, mapped to [CWE-269]. The handler passes user-controlled data directly to WordPress user update routines without whitelisting allowed fields or calling current_user_can() against a role-changing capability such as promote_users. As a result, the role field is treated as user-editable data.

Attack Vector

Exploitation is network-based and requires low privileges. An attacker registers or logs in as a Subscriber, then issues a crafted AJAX request to the plugin's password update endpoint that includes a role field. The server accepts the parameter and assigns the attacker the Administrator role, granting full site control including plugin installation, arbitrary PHP execution, and database access. Review the WordPress Plugin Source Code at line 3803 and the Wordfence Vulnerability Report for the vulnerable handler details.

No verified public proof-of-concept code is available. See the referenced advisories for technical specifics on the vulnerable function.

Detection Methods for CVE-2024-6482

Indicators of Compromise

Unexpected role changes in the wp_usermeta table where meta_key = 'wp_capabilities' for accounts that were previously Subscribers or Customers
New Administrator accounts created shortly after Subscriber registration or login events
POST requests to admin-ajax.php invoking the lwp_update_password_action action with parameters beyond password and confirm_password
Installation of unfamiliar plugins, themes, or .php files in wp-content/uploads/ following a role change event

Detection Strategies

Audit the WordPress user database for role transitions from subscriber to administrator that lack a corresponding administrative action in the audit log
Deploy a Web Application Firewall (WAF) rule to block AJAX requests to lwp_update_password_action that contain a role, wp_capabilities, or similar privilege-related field
Correlate user_register, profile_update, and set_user_role events from WordPress logs against source IP and session identifiers

Monitoring Recommendations

Enable a security or activity logging plugin to record role changes, capability updates, and plugin installations with attribution
Forward WordPress and web server logs to a central data lake for retention and correlation across sites in the estate
Alert on the creation of new Administrator accounts or any elevation from Subscriber to a privileged role

How to Mitigate CVE-2024-6482

Immediate Actions Required

Update the Login with Phone Number plugin to a version later than 1.7.49 that contains the complete fix
Review all WordPress user accounts and revoke any unauthorized Administrator or Editor role assignments
Rotate credentials and application passwords for all administrative accounts and force a global password reset
Inspect the site for backdoors, rogue plugins, and modified core files if exploitation is suspected

Patch Information

The vendor addressed the flaw incrementally. Version 1.7.40 introduced a partial fix that limited exploitation to environments also running the Login with Phone Number Pro plugin. The complete fix is committed in WordPress Changeset #3129185, delivered in a release subsequent to 1.7.49. Administrators should install the latest available version from the official WordPress plugin repository.

Workarounds

Deactivate and remove the Login with Phone Number plugin until the patched version is installed
Disable open user registration under Settings → General → Membership to prevent attackers from obtaining Subscriber accounts
Add a WAF rule to strip role and wp_capabilities parameters from requests targeting admin-ajax.php with the lwp_update_password_action action

bash

# WAF rule example blocking role tampering on the vulnerable endpoint
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1006482,msg:'Block CVE-2024-6482 role tampering'"
  SecRule ARGS:action "@streq lwp_update_password_action" \
    "chain"
    SecRule ARGS_NAMES "@rx ^(role|wp_capabilities)$" "t:lowercase"