Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · login-with-phone-number
Login with phone number
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 18, 2026Login with phone number: Incorrect Privilege AssignmentCVE-2026-110373 · affects up to 1.8.77 · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.
Oct 15, 2026Login with phone number: Missing AuthorizationCVE-2026-110374 · affects up to 1.8.77 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Aug 6, 2026Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.CVE-2026-65570 · affects up to 1.8.70 · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
Aug 5, 2026OTP Login With Phone Number, OTP Verification: Does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guessCVE-2026-15210 · fixed in 1.8.71 · reported by WPScanCritical 9.1
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.
May 29, 2026OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2026-3655 · affects up to 1.8.60 · reported by WordfenceCritical 9.8
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · affects up to 1.6.93 · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
Aug 14, 2025WooCommerce OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2025-8342 · affects up to 1.8.47 · reported by WordfenceHigh 8.1
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 14, 2024Login with phone number: Privilege escalationCVE-2024-6482 · affects up to 1.7.49 · reported by WordfenceHigh 8.8
The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2024Login with phone number: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37429 · affects up to 1.7.35 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.35.
Jun 18, 2024Login with phone number: Unauthorized password resetsCVE-2024-6125 · affects up to 1.7.34 · reported by WordfenceHigh 8.1
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.
May 28, 2024Login with phone number: Authentication bypassCVE-2024-5150 · affects up to 1.7.26 · fixed in 1.7.27 · reported by WordfenceCritical 9.8
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024Login with phone number: Incorrect Privilege AssignmentCVE-2024-32507 · affects up to 1.7.16 · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16.
May 6, 2024Login with phone number: Missing AuthorizationCVE-2024-34371 · affects up to 1.7.18 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.
Apr 15, 2024Login with phone number: Cross-Site Request Forgery (CSRF)CVE-2024-31424 · affects up to 1.6.93 · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
Sep 12, 2023Login with phone number: Cross-Site Request ForgeryCVE-2023-4916 · affects up to 1.5.6 · reported by WordfenceHigh 8.8
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · fixed in 1.3.8 · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Mar 14, 2022Login with phone number: Includes a file deleteCVE-2022-0593 · fixed in 1.3.7 · reported by WPScanMedium 6.5
The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.