CVE-2023-4916

Name of the Vulnerable Software and Affected Versions Login with phone number plugin for WordPress versions up to, and including, 1.5.6

Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the lwp update password action function. This allows unauthenticated attackers to change user passwords via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For versions up to, and including, 1.5.6, consider disabling the lwp update password action function until a patch is available to prevent exploitation. Restrict access to sensitive areas of the site to minimize the risk of attackers tricking administrators into performing malicious actions.