CVE-2024-6482: 
WordPress vulnerability analysis and mitigation

The Login with phone number plugin for WordPress contains a privilege escalation vulnerability (CVE-2024-6482) affecting all versions up to and including 1.7.49. The vulnerability was discovered and reported by researcher Thanh Nam Tran, with initial disclosure on September 14, 2024 (NVD CVE).

The vulnerability stems from a lack of validation and missing capability check on user-supplied data in the 'lwpupdatepassword_action' function. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-269 (Improper Privilege Management) (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with Subscriber-level access or higher to escalate their privileges by updating their role to any other role, including Administrator. This gives attackers full administrative control over the WordPress installation (NVD CVE).

Website administrators are advised to update the Login with phone number plugin to a version newer than 1.7.49 to address this vulnerability. A patch has been released through the WordPress plugin repository (WordPress Plugin).