Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion

2022-02-1600:00:00

Michal Lipinski

unauthenticated

remote

plugin deletion

exploit

EPSS

0.001

Percentile

36.6%

JSON

The plugin includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.

http://example/wp-content/plugins/login-with-phone-number/delete.php?delete=1

References

wordpress.org/plugins/login-with-phone-number

EPSS

0.001

Percentile

36.6%

JSON

Related for WPEX-ID:76A50157-04B5-43E8-AFBC-A6DDF6D1CBA3