CVE-2024-5150: 
WordPress vulnerability analysis and mitigation

The Login with phone number plugin for WordPress contains an authentication bypass vulnerability (CVE-2024-5150) affecting versions up to and including 1.7.26. The vulnerability was discovered and reported by Wordfence, with initial disclosure on May 28, 2024 (NVD).

The vulnerability stems from the 'activation_code' default value being empty and a missing empty check in the 'lwp_ajax_register' function. This implementation flaw received a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (Wordfence).

The vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators, if they have access to the user's email. This presents a critical security risk as it could lead to complete site compromise through unauthorized administrative access (NVD).

The vulnerability is exploitable remotely by unauthenticated attackers with only knowledge of a user's email address. No special conditions or user interaction is required for exploitation, making this a particularly dangerous security flaw (Wordfence).

The vulnerability was initially patched in version 1.7.26, however, this patch contained an issue that caused the entire function to stop working. A complete fix was released in version 1.7.27. Users are strongly advised to update to version 1.7.27 or later to properly address this security issue (NVD).