What the vulnerability does
01Description
The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.
Explanation of Vulnerability in Simple Terms
02Summary
The Digits WordPress plugin through version 9.1.0.5 contains a privilege management flaw that allows authenticated users with low-level permissions to gain unauthorized access to sensitive data and modify site content. An attacker with a basic user account can read private information, alter posts and settings, and potentially disrupt site availability without requiring additional user interaction.
What an attacker can do
03Attacker Capabilities
Read private data, modify site content, and disrupt availability with a low-privilege user account.
Potential impact on your site
04Site Impact
Compromised user accounts can escalate privileges to read, edit, or delete sensitive data and site configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege WordPress user account; no user interaction required.
Key dates
06Disclosure timeline
July 16, 2026
CVE published
July 16, 2026
Record updated
