CVE-2024-6125

The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing a 6-digit numeric reset code.

• CWE-640

• https://plugins.trac.wordpress.org/changeset/3104085/login-with-phone-number#file5
• https://www.wordfence.com/threat-intel/vulnerabilities/id/301a67a5-226c-413a-9198-66747d1b1fd3?source=cve
• https://plugins.trac.wordpress.org/changeset/3104085/login-with-phone-number#file5
• https://www.wordfence.com/threat-intel/vulnerabilities/id/301a67a5-226c-413a-9198-66747d1b1fd3?source=cve

Published

Jun 19, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6119Issue summary: Applications performing certificate name chec…7.5
• CVE-2024-6120The Sparkle Demo Importer plugin for WordPress is vulnerable…6.5
• CVE-2024-6121An out-of-date version of Redis shipped with NI SystemLink S…7.8
• CVE-2024-6122An incorrect permission in the installation directory for th…5.5
• CVE-2024-6123The Bit Form plugin for WordPress is vulnerable to arbitrary…7.2
• CVE-2024-6124Reflected XSS in M-Files Hubshare before version 5.0.6.0 all…5.4
• CVE-2024-6126A flaw was found in the cockpit package. This flaw allows an…3.2
• CVE-2024-6127BC Security Empire before 5.9.3 is vulnerable to a path trav…9.8
• CVE-2024-6128A vulnerability, which was classified as problematic, has be…5.3
• CVE-2024-6129A vulnerability, which was classified as problematic, was fo…3.7
• CVE-2024-6130The Form Maker by 10Web WordPress plugin before 1.15.26 doe…4.8
• CVE-2024-6132The Pexels: Free Stock Photos plugin for WordPress is vulner…8.8