CVE-2026-28165: Digits Plugin Privilege Escalation Flaw

CVE-2026-28165 Overview

CVE-2026-28165 is an unauthenticated privilege escalation vulnerability in the Digits WordPress plugin affecting versions 9.2 and earlier. The Digits plugin provides phone-number-based registration and login functionality for WordPress sites. The flaw permits remote attackers to escalate privileges without authentication, potentially granting administrative access to the target WordPress installation. The vulnerability is classified under CWE-266: Incorrect Privilege Assignment.

Critical Impact
Unauthenticated attackers can escalate privileges to administrator over the network, resulting in full compromise of the WordPress site including content, user data, and connected services.

Affected Products

Digits WordPress plugin versions <= 9.2
WordPress installations using Digits for phone-based registration and login
Any site relying on Digits for OTP-based authentication flows

Discovery Timeline

2026-08-24 - CVE-2026-28165 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-28165

Vulnerability Analysis

The Digits plugin implements phone-number registration, login, and one-time password (OTP) verification for WordPress. The vulnerability allows an unauthenticated remote attacker to obtain a higher-privileged role than intended during account registration or authentication flows. Because WordPress role assignment gates access to administrative functionality, an incorrect privilege assignment during a public-facing request path exposes the entire site.

The issue is categorized as Incorrect Privilege Assignment ([CWE-266]). Vulnerabilities of this class typically arise when user-controlled input influences role selection, when default roles are assigned improperly, or when nonce and capability checks are missing from endpoints that mutate user state.

EPSS data for CVE-2026-28165 reports a probability of 0.268% with a percentile of 18.561. Public exploitation has not been confirmed and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Root Cause

The root cause resides in the plugin's account provisioning or authentication logic, where privilege assignment occurs without adequate validation of the requesting context. The absence of authenticated capability checks on a state-changing endpoint permits a network attacker to influence the role granted to a new or existing account. See the Patchstack advisory for vendor-specific technical details.

Attack Vector

Exploitation occurs over the network against the WordPress site's public endpoints exposed by the Digits plugin. No authentication, user interaction, or elevated privileges are required. An attacker sends crafted requests to the vulnerable Digits routes to register or update an account with elevated privileges, then authenticates using the resulting credentials to access the WordPress administrative dashboard.

Verified proof-of-concept code has not been published. Site operators should treat any WordPress instance running Digits <= 9.2 as exposed until patched.

Detection Methods for CVE-2026-28165

Indicators of Compromise

Unexpected new WordPress accounts with administrator or other elevated roles created without corresponding admin activity
Role changes on existing accounts recorded outside normal administrative workflows
Requests to Digits plugin AJAX endpoints (paths containing digits, digits_ajax, or OTP handlers) from unfamiliar IP addresses
Successful wp-login.php or REST API authentications from accounts that never received an admin invitation

Detection Strategies

Audit the WordPress wp_users and wp_usermeta tables for accounts with wp_capabilities set to administrator or editor that lack a legitimate provisioning record
Correlate web server access logs against Digits plugin endpoints for anomalous POST volumes or repeated parameter permutations
Review the WordPress audit log or activity plugin history for role changes lacking an authenticated administrator actor
Alert on new admin session creation followed by plugin, theme, or user modifications within a short window

Monitoring Recommendations

Ingest WordPress access, error, and audit logs into a centralized platform and retain them for forensic review
Baseline normal request rates to Digits endpoints and alert on deviations
Monitor for outbound connections from the web server to unknown hosts following administrator logins
Track file integrity of wp-content/plugins, wp-content/themes, and the WordPress core to detect post-exploitation persistence

How to Mitigate CVE-2026-28165

Immediate Actions Required

Update the Digits plugin to a version later than 9.2 as soon as the vendor publishes a fixed release; consult the Patchstack advisory for the current patched version
Enumerate all WordPress user accounts and remove or demote any unauthorized administrator or editor accounts
Rotate credentials, application passwords, and API keys for all WordPress administrator accounts
Invalidate active sessions by rotating WordPress secret keys and salts in wp-config.php

Patch Information

The vendor advisory hosted by Patchstack tracks the fixed release for the Digits plugin. Site operators should apply the update through the WordPress admin dashboard under Plugins or by deploying the updated plugin package from the WordPress plugin repository. Verify the installed version via wp plugin list after patching.

Workarounds

Disable and remove the Digits plugin until the patched version is installed if phone-based authentication is not business-critical
Restrict access to WordPress registration and Digits AJAX endpoints using a web application firewall rule that blocks unauthenticated privilege-change parameters
Enforce multi-factor authentication on all administrator accounts to reduce the value of any illicitly created account
Place the WordPress admin area behind an IP allowlist or authenticated reverse proxy

bash

# Configuration example: WP-CLI commands to audit and remediate
wp plugin list --name=digits --fields=name,status,version
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp config shuffle-salts
wp user session destroy --all <user_id>