2 matches found
CVE-2023-23492
The Login with Phone Number WordPress Plugin, version
CVE-2023-4916
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password vi...