CVE-2024-6482

The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php#L3803	Product
https://plugins.trac.wordpress.org/changeset/3129185/	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-09-14 13:15

Updated : 2024-09-27 13:54

NVD link : CVE-2024-6482

Mitre link : CVE-2024-6482

CVE.ORG link : CVE-2024-6482

JSON object : View

Products Affected

idehweb

login_with_phone_number

CWE

CWE-269

Improper Privilege Management

NVD-CWE-noinfo

{"id": "CVE-2024-6482", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-09-14T13:15:10.343", "references": [{"url": "https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php#L3803", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3129185/", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49."}, {"lang": "es", "value": "El complemento Login with phone number para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta la 1.7.49 incluida. Esto se debe a la falta de validaci\u00f3n y a la falta de comprobaci\u00f3n de la capacidad de los datos suministrados por el usuario en la funci\u00f3n 'lwp_update_password_action'. Esto permite que los atacantes autenticados, con acceso de nivel de suscriptor o superior, actualicen su rol a cualquier otro rol, incluido el de administrador. La vulnerabilidad fue parcialmente corregida en la versi\u00f3n 1.7.40. El complemento Login with phone number pro era necesario para explotar la vulnerabilidad en las versiones 1.7.40 - 1.7.49."}], "lastModified": "2024-09-27T13:54:53.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "E2A5DD2A-1F8D-4E9B-8F99-8555B246BFDF", "versionEndExcluding": "1.7.50", "versionStartIncluding": "1.7.40"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}