CVE-2024-32832CWE-862broken-access-control

CVE-2024-32832

Critical · published August 31, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

🚨 An unguarded door is wide open! The missing authorization in the Hamid Alinia Login with phone number feature allows anyone to access accounts without proper checks. 🔥 Think of it like a party where the guest list is never checked — anyone can waltz in and take a seat, no questions asked. Without proper authorization, it’s like leaving the front door to your home unlocked, inviting in anyone who wants to take a look around! An attacker could exploit this flaw to gain access to any user's account, potentially exposing sensitive information, altering data, or even locking users out entirely. The consequences can be absolutely devastating for users, as their privacy and security are thrown to the wind!

Put simply

Think of it like a party where the guest list is never checked — anyone can waltz in and take a seat, no questions asked. Without proper authorization, it’s like leaving the front door to your home unlocked, inviting in anyone who wants to take a look around! The vulnerability in the Login with phone number feature allows attackers to bypass authorization checks, giving them unauthorized access to user accounts. This issue affects versions from n/a to 1.6.93, making it a critical security hole for anyone using this system.

What to do

An attacker could exploit this flaw to gain access to any user's account, potentially exposing sensitive information, altering data, or even locking users out entirely. The consequences can be absolutely devastating for users, as their privacy and security are thrown to the wind! Update to the latest version of Hamid Alinia Login, which addresses this missing authorization flaw. Ensure that authentication processes are thoroughly reviewed and implement strict authorization checks across all user login methods. You’ve got this! Follow these steps to secure your application and protect your users. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-08-31T08:15Z
References (1)
EPSS history
Timeline
  • 31 AUG 03:47Z
    WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability
    cvelistv5