CVE-2026-110373 Hamid Alinia CVE debrief

Who should care

Defenders and administrators of WordPress systems using the Login with phone number plugin should assess potential exposure and prioritize verification and mitigation efforts.

Why it matters

CVE-2026-110373 is a HIGH-severity vulnerability in the Login with phone number plugin for WordPress, allowing for Privilege Escalation. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using the affected plugin versions.

• Potential Privilege Escalation requires verification from official sources
• Defenders should verify exposure and assess potential impact on systems using the affected plugin versions
• Further verification is needed to determine the actual impact and affected scope

Technical summary

The Login with phone number plugin for WordPress has a HIGH-severity vulnerability (CVSS Score: 8.1) due to Incorrect Privilege Assignment, allowing for Privilege Escalation. The issue affects versions from n/a through 1.8.77. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using the affected plugin versions. The vulnerability requires verification from official sources, and defenders should verify exposure and assess potential impact on systems using the affected plugin versions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using the affected plugin versions.

Recommended defensive actions

• Verify if the Login with phone number plugin is installed and assess the version
• Check for any available updates or patches for the plugin
• Monitor system logs for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide limited information on the vulnerability. Further verification is needed to determine the actual impact and affected scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.