WordPress security by component

OTP Login With Phone Number, OTP Verification

Plugin description

OTP Login With Phone Number, OTP Verification is a WordPress component with 14 published CVE records in this archive. The latest tracked vulnerability was published May 29, 2026; the highest CVE/CNA score is 9.8.

Plugin slug: login-with-phone-number

Latest vulnerability

CVE-2026-3655: OTP Login With Phone Number, OTP Verification: Privilege escalation or authentication bypass

OTP Login With Phone Number, OTP Verification is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is 1.8.50 through 1.8.60.

PublishedMay 29, 2026

Known safe version> 1.8.60

		Safe version
May 29, 2026	CVE-2026-3655 OTP Login With Phone Number, OTP Verification: Privilege escalation or authentication bypass OTP Login With Phone Number, OTP Verification is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is 1.8.50 through 1.8.60.	> 1.8.60	CVE9.8 NVDPending
Aug 31, 2025	CVE-2024-32832 Login with phone number: A security weakness Login with phone number is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.8 NVDPending
Aug 15, 2025	CVE-2025-8342 WooCommerce OTP Login With Phone Number, OTP Verification: Privilege escalation or authentication bypass WooCommerce OTP Login With Phone Number, OTP Verification is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.1 NVDPending
Sep 14, 2024	CVE-2024-6482 Login with phone number: Privilege escalation or authentication bypass Login with phone number is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVDPending
Jul 22, 2024	CVE-2024-37429 Login with phone number: Cross-site scripting Login with phone number is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Jun 19, 2024	CVE-2024-6125 Login with phone number: A security weakness Login with phone number is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.1 NVDPending
May 29, 2024	CVE-2024-5150 Login with phone number: Privilege escalation or authentication bypass Login with phone number is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.8 NVDPending
May 17, 2024	CVE-2024-32507 Login with phone number: A security weakness Login with phone number is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.8 NVDPending
May 06, 2024	CVE-2024-34371 Login with phone number: A security weakness Login with phone number is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Apr 15, 2024	CVE-2024-31424 Login with phone number: Cross-site request forgery Login with phone number is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVDPending
Sep 13, 2023	CVE-2023-4916 Login with phone number: Cross-site request forgery Login with phone number is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVDPending
Jan 20, 2023	CVE-2023-23492 Login with Phone Number: SQL injection Login with Phone Number is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD8.8
Aug 01, 2022	CVE-2022-0598 Login with phone number: Cross-site scripting Login with phone number is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Mar 14, 2022	CVE-2022-0593 Login with phone number: A security weakness Login with phone number is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVD6.5