CVE-2023-23492

HIGH NUCLEI

Login with Phone Number WordPress Plugin < 1.4.2 - Authenticated SQL Injection via ID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-23492 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.

Nuclei Templates (1)

Login with Phone Number - Cross-Site Scripting
HIGHVERIFIEDby r3Y3r53

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.5740
EPSS Percentile 99.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
idehweb/login_with_phone_number < 1.4.2
Published Jan 20, 2023
Tracked Since Feb 18, 2026