WordPress Login with phone number Plugin <= 1.7.49 is vulnerable to Privilege Escalation

Software Login with phone number Type Plugin Vulnerable versions = 1.7.49 Fixed in 1.7.50 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-6482 Patch priority High CVSS severity High 8.8 Developer Hamid Alinia PSID 2e6bc4e24930 Credits Thanh Nam Tran Require...

CVE-2024-6482

creationtimestamp| type| source ---|---|--- 2024-09-14 15:41:35+00:00| seen| https://t.me/cvedetector/5673...

CVE-2024-6482 Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwpupdatepasswordaction' function. This makes it possible for...

MSC-2024-6482

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...