CVE-2024-31424: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress Login with Phone Number plugin, affecting versions up to 1.6.93. The vulnerability was identified on April 10, 2024, and was assigned CVE-2024-31424 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-352 (Cross-Site Request Forgery) and affects the plugin developed by Hamid Alinia - idehweb (Patchstack).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The high CVSS score indicates potential severe impacts on the confidentiality, integrity, and availability of the affected system (Patchstack).

The vulnerability requires no privileges (unauthenticated) to exploit, though it does require user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Patchstack).

The vulnerability has been fixed in version 1.6.94 of the Login with Phone Number plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).