PT-2026-3355 · WordPress · Registration & Login With Mobile Phone Number For Woocommerce

Vahan Petrosyan · Publicado 2026-01-17 · Atualizado 2026-01-30 · CVE-2025-10484

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress versions prior to 1.3.2

Description The plugin does not properly verify a user’s identity prior to authentication, specifically through the fma lwp set session php fun() function. This allows unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.

Recommendations Update the Registration & Login with Mobile Phone Number for WooCommerce plugin to version 1.3.2 or later.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-10484

Produtos afetados

Registration & Login With Mobile Phone Number For Woocommerce

Referências · 10

• https://twitter.com/MNovofastovsky/status/2017270501819773011 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=cve · Nota
• https://twitter.com/0dayPublishing/status/2012441288960860348 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-10484 · Nota de Segurança
• https://twitter.com/cracbot/status/2014292000825286825 · Publicação no Twitter
• https://woocommerce.com/products/registration-login-with-mobile-phone-number · Nota
• https://twitter.com/CveFindCom/status/2012459636767564191 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2012454868959764647 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2012490340767301778 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2012473808523858338 · Publicação no Twitter