What the vulnerability does
01Description
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.
Explanation of Vulnerability in Simple Terms
02Summary
The Registration & Login with Mobile Phone Number for WooCommerce plugin through version 1.3.1 contains an authentication bypass vulnerability. An attacker can gain unauthorized access to user accounts without valid credentials. The vulnerability requires no special privileges or user interaction, making it trivial to exploit at scale. All installations of the affected plugin version are at immediate risk.
What an attacker can do
03Attacker Capabilities
Gain unauthorized access to any WooCommerce user account without knowing the password.
Potential impact on your site
04Site Impact
Attackers can log in as any customer or admin, access orders, modify accounts, and potentially compromise the entire WooCommerce store.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 17, 2026
CVE published
April 8, 2026
Record updated
