CVE-2024-6125 HIGH

CVE-2024-6125: Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism

Vendor Glboy
Product OTP Login With Phone Number, OTP Verification
Weakness CWE-640 · Weak password recovery
Published June 19, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.

Key dates

02Disclosure timeline

June 19, 2024 CVE published
April 8, 2026 Record updated