CVE-2026-110373: Login with Phone Number Privilege Escalation

CVE-2026-110373 is a privilege escalation vulnerability in the Login with Phone Number WordPress plugin that allows attackers to gain unauthorized elevated access through incorrect privilege assignment. This article covers technical details, affected versions through 1.8.77, impact assessment, and mitigation strategies.

CVE-2026-110373 Overview

CVE-2026-110373 is an Incorrect Privilege Assignment vulnerability [CWE-266] in the Hamid Alinia Login with phone number plugin for WordPress. The flaw affects all versions up to and including 1.8.77. An unauthenticated remote attacker can abuse the privilege assignment logic to escalate privileges within an affected WordPress site. The weakness is network-reachable and requires no user interaction, though the attack complexity is high.

Critical Impact
Successful exploitation can grant an attacker elevated privileges in WordPress, compromising confidentiality, integrity, and availability of the site.

Affected Products

Hamid Alinia Login with phone number WordPress plugin
All versions from n/a through 1.8.77
WordPress sites with the plugin active

Discovery Timeline

2026-10-18 - CVE-2026-110373 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110373

Vulnerability Analysis

The plugin assigns privileges incorrectly during account creation or authentication handling tied to phone number login flows. An unauthenticated attacker reaching the plugin's endpoints can trigger logic that associates a controlled account with elevated capabilities. Because the vector is network-based and requires no credentials or user interaction, exposure is broad for any site running a vulnerable version. The flaw affects the three primary security properties: an attacker gaining elevated roles can read restricted data, modify site content and configuration, and disrupt availability.

Root Cause

The root cause is Incorrect Privilege Assignment [CWE-266]. The plugin fails to properly validate or constrain the role or capability granted to a user during registration or login via phone number. Instead of binding new or authenticating accounts to a least-privileged role, the plugin accepts or infers privilege data in a way an attacker can influence. This design error allows role elevation outside the intended authorization boundary.

Attack Vector

The attack vector is Network (AV:N) and requires no authentication (PR:N) or user interaction (UI:N). Exploitation complexity is high, suggesting the attacker must satisfy specific preconditions such as crafting particular request parameters or winning a timing or state condition. A successful request against the plugin's registration or login handler results in an account being assigned a role above the intended subscriber-level privilege.

No verified proof-of-concept code is published. See the Patchstack Vulnerability Report for additional vendor-coordinated technical details.

Detection Methods for CVE-2026-110373

Indicators of Compromise

Unexpected WordPress accounts with administrator, editor, or other elevated roles created without administrator action.
Role or capability changes in the wp_usermeta table that do not correspond to legitimate admin activity.
Anomalous POST requests to plugin endpoints associated with phone number registration or login handlers.
New administrator sessions originating from IP addresses or user agents not seen in prior admin activity.

Detection Strategies

Audit WordPress user roles and compare current role assignments against a known-good baseline.
Review web server access logs for repeated or malformed requests targeting login-with-phone-number plugin endpoints.
Enable WordPress audit logging to capture user creation, role changes, and capability updates in real time.
Correlate plugin activity with authentication events to spot role elevation that bypasses standard administrative workflows.

Monitoring Recommendations

Alert on any privilege change to administrator or custom high-privilege roles outside approved change windows.
Monitor plugin AJAX and REST endpoints for anomalous traffic spikes or parameter tampering.
Forward WordPress and web server logs to a centralized SIEM or data lake for retention and query against known IOCs.

How to Mitigate CVE-2026-110373

Immediate Actions Required

Identify all WordPress sites running the Hamid Alinia Login with phone number plugin at version 1.8.77 or earlier.
Deactivate the plugin until a patched version is installed if a fix is not yet available on your sites.
Review and remove any unauthorized administrator or elevated-role accounts.
Rotate credentials and session tokens for all administrative users.

Patch Information

At the time of publication, the advisory lists affected versions through 1.8.77. Site operators should consult the Patchstack Vulnerability Report for the fixed version and upgrade immediately once available. Apply the vendor-supplied update across all WordPress instances using the plugin.

Workarounds

Deactivate and remove the login-with-phone-number plugin until a patched release is deployed.
Restrict access to WordPress registration and plugin AJAX endpoints using a web application firewall ruleset.
Enforce multi-factor authentication for all administrator accounts to limit the impact of role elevation.
Apply least-privilege principles to WordPress roles and remove unused administrator accounts.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate login-with-phone-number
wp plugin delete login-with-phone-number

# List users with administrator role for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered