CVE-2024-34371: 
WordPress vulnerability analysis and mitigation

The Login with phone number WordPress plugin contains a Missing Authorization vulnerability (CVE-2024-34371) affecting versions up to and including 1.7.18. The vulnerability was discovered on January 20, 2024, and publicly disclosed on May 3, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The security flaw exists in the idehweb_lwp_update_billing_phones function which lacks proper capability checks (WPScan).

The vulnerability allows authenticated attackers with subscriber-level access or higher to modify billing phone numbers without proper authorization. This represents a broken access control issue that could lead to unauthorized modification of data (Patchstack).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 1.7.20 of the Login with phone number plugin. Users are advised to update to this version or later to remediate the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).