CVE-2026-110374 Overview
CVE-2026-110374 is a Missing Authorization vulnerability [CWE-862] in the Hamid Alinia Login with phone number WordPress plugin. The flaw affects all versions up to and including 1.8.77. The plugin fails to enforce correct access control checks on sensitive actions, allowing authenticated users with low privileges to perform operations they should not be permitted to execute. The vulnerability has a network attack vector and requires low privileges without user interaction. Impact is limited to integrity, with no direct confidentiality or availability consequences.
Critical Impact
Authenticated users with minimal privileges can abuse incorrectly configured access control to modify plugin-controlled state in WordPress installations running vulnerable versions of login-with-phone-number.
Affected Products
- Hamid Alinia Login with phone number plugin for WordPress
- All versions from unspecified initial release through 1.8.77
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2026-10-15 - CVE-2026-110374 published to the National Vulnerability Database (NVD)
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-110374
Vulnerability Analysis
The vulnerability stems from missing authorization checks in one or more plugin endpoints exposed to authenticated WordPress users. The plugin exposes functionality that assumes callers possess appropriate roles or capabilities, but does not verify this server-side. An attacker holding any authenticated session, including a subscriber account on sites allowing open registration, can invoke these endpoints and perform actions outside their intended privilege scope.
The scope of integrity impact is limited rather than total. Attackers cannot read sensitive data or disrupt site availability through this flaw alone. However, broken access control in authentication-adjacent plugins frequently serves as a stepping stone for account takeover or configuration tampering workflows.
Root Cause
The root cause is a Missing Authorization weakness [CWE-862]. The plugin registers handlers, likely AJAX actions or REST routes, that execute privileged operations without calling current_user_can() or verifying a nonce tied to a privileged capability. WordPress plugins commonly rely on wp_ajax_ hooks that fire for any logged-in user unless explicit capability checks are coded in the callback.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid authenticated session with low privileges. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint, bypassing the implied authorization model. No user interaction is required from a site administrator. Full technical details are documented in the Patchstack Vulnerability Report.
No verified proof-of-concept code is publicly available for CVE-2026-110374.
Refer to the Patchstack advisory linked above for vendor-coordinated technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110374
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with action parameters associated with the login-with-phone-number plugin originating from low-privilege user sessions.
- Requests to plugin REST endpoints under /wp-json/ from subscriber-level accounts.
- Unexplained changes to plugin settings, OTP configuration, or user phone number mappings in the WordPress database.
Detection Strategies
- Enable WordPress audit logging to capture plugin configuration changes and privileged action invocations by non-administrator accounts.
- Deploy a web application firewall rule to flag or block requests to login-with-phone-number AJAX actions when the authenticated role is below the expected threshold.
- Correlate authentication telemetry with administrative actions to detect privilege boundary violations.
Monitoring Recommendations
- Monitor the installed plugin version and alert when any site runs login-with-phone-number at version 1.8.77 or earlier.
- Baseline normal request patterns to the plugin's endpoints and alert on anomalies from subscriber accounts.
- Review WordPress user role assignments and new user registrations for suspicious activity.
How to Mitigate CVE-2026-110374
Immediate Actions Required
- Identify all WordPress installations running the login-with-phone-number plugin and inventory the installed versions.
- Update the plugin to a fixed release once published by the vendor; consult the Patchstack advisory for the patched version.
- Audit existing WordPress accounts and remove or restrict unused low-privilege accounts, particularly on sites with open user registration.
Patch Information
At publication, the advisory lists versions through 1.8.77 as affected. Site operators should apply the vendor-supplied patched version as soon as it is available. Monitor the Patchstack Vulnerability Report for the fixed release identifier.
Workarounds
- Deactivate the login-with-phone-number plugin until a patched release is deployed if phone-based login is non-critical.
- Restrict new user registration on affected WordPress sites to reduce the pool of accounts that can reach vulnerable endpoints.
- Apply web application firewall rules that block unauthorized access to the plugin's AJAX and REST routes based on user role context.
# Example WP-CLI commands to inventory and disable the plugin
wp plugin list --name=login-with-phone-number --fields=name,status,version
wp plugin deactivate login-with-phone-number
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
