CVE-2024-5150criticalCWE-288

CVE-2024-5150: falha crítica em glboy OTP Login With Phone Number, OTP…

Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OTP Login With Phone Number, OTP Verification

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.8%
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user email. The vulnerability is patched in version 1.7.26, but there is an issue in the patch that causes the entire function to not work, and this issue is fixed in version 1.7.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
glboy · OTP Login With Phone Number, OTP Verification
CVEs relacionadas — glboy OTP Login With Phone Number, OTP…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8342HIGHWooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication BypassEPSS 0.7%CVE-2026-3655CRITICALOTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP VerificationEPSS 0.5%CVE-2024-6482HIGHLogin with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege EscalationEPSS 0.5%CVE-2024-6125HIGHLogin with phone number <= 1.7.34 - Insecure Password Reset MechanismEPSS 0.5%CVE-2023-4916HIGHLogin with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password ChangeEPSS 0.4%