{
 "id": "WPSEC-2026-0987",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0987/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0987/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0987/index.md",
 "title": "OTP Login With Phone Number, OTP Verification <= 1.8.77 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Address Takeover via Email Change",
 "description": "The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to Insecure Direct Object Reference via the email-change flow (lwp_ajax_verify_with_email and lwp_activate_email AJAX actions) in all versions up to, and including, 1.8.77. This is due to the plugin accepting an email address already owned by another account as the pending address, and not binding the activation code to that pending address. Any code issued to the requesting user, for example to their own email address, is therefore accepted. On successful verification the plugin removes the email address from the other account and assigns it to the requester. This makes it possible for authenticated attackers, with subscriber-level access and above, to remove any user's email address, including an administrator's, and claim it for their own account.",
 "plugin": {
  "slug": "login-with-phone-number",
  "name": "OTP Login With Phone Number, OTP Verification",
  "full_name": "OTP Login With Phone Number, OTP Verification",
  "wordpress_org": "https://wordpress.org/plugins/login-with-phone-number/",
  "advisories_url": "https://wpsec.com/vuln/plugin/login-with-phone-number/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/login-with-phone-number"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.78",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.78"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.78",
 "remediation": "Update to 1.8.78 or later.",
 "fix_released": "2026-10-14T08:35:18+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:15:52.515884+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0987/",
  "https://plugins.svn.wordpress.org/login-with-phone-number/tags/1.8.78/",
  "https://wordpress.org/plugins/login-with-phone-number/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/login-with-phone-number",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}