PT-2026-3355 · WordPress · Registration & Login With Mobile Phone Number For Woocommerce

Vahan Petrosyan · Published 2026-01-17 · Updated 2026-01-30 · CVE-2025-10484

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress versions prior to 1.3.2

Description The plugin does not properly verify a user’s identity prior to authentication, specifically through the fma lwp set session php fun() function. This allows unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.

Recommendations Update the Registration & Login with Mobile Phone Number for WooCommerce plugin to version 1.3.2 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-10484

Affected Products

Registration & Login With Mobile Phone Number For Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-10484 · Security Note
• https://twitter.com/MNovofastovsky/status/2017270501819773011 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=cve · Note
• https://twitter.com/0dayPublishing/status/2012441288960860348 · Twitter Post
• https://twitter.com/cracbot/status/2014292000825286825 · Twitter Post
• https://woocommerce.com/products/registration-login-with-mobile-phone-number · Note
• https://twitter.com/CveFindCom/status/2012459636767564191 · Twitter Post
• https://twitter.com/TheHackerWire/status/2012454868959764647 · Twitter Post
• https://twitter.com/CVEnew/status/2012490340767301778 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012473808523858338 · Twitter Post