CVE-2023-4916
📋 TL;DR
This CSRF vulnerability in the WordPress Login with phone number plugin allows unauthenticated attackers to change user passwords by tricking administrators into clicking malicious links. All WordPress sites using vulnerable plugin versions are affected, potentially leading to account takeover.
💻 Affected Systems
- WordPress Login with phone number plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Site administrator account compromise leading to complete website takeover, data theft, malware injection, or site defacement.
Likely Case
Privileged user account compromise enabling content manipulation, plugin/theme installation, or data access.
If Mitigated
No impact if proper CSRF protections are in place or plugin is updated/disabled.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious links or visiting compromised sites.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.7 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2967707
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Login with phone number' plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.5.7+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Login with phone number plugin until patched
wp plugin deactivate login-with-phone-number
Implement CSRF protection middleware
allAdd WordPress nonce validation to all form submissions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block CSRF attacks targeting password reset endpoints
- Restrict admin panel access to specific IP addresses or VPN-only connections
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Login with phone number → Version. If version is 1.5.6 or lower, you are vulnerable.Check Version:
wp plugin get login-with-phone-number --field=versionVerify Fix Applied:
Verify plugin version is 1.5.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple password change requests from same IP without corresponding login
- POST requests to /wp-admin/admin-ajax.php with action=lwp_update_password_action
Network Indicators:
- Unusual outbound connections after admin visits
- CSRF payloads in HTTP referer headers
SIEM Query:
source="wordpress.log" AND ("lwp_update_password_action" OR "password changed" AND NOT "user logged in")🔗 References
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2965324#L2942
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2967707#L2948
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71083db7-377b-47a1-ac8b-83d8974a2654?source=cve
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2965324#L2942
- https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php?rev=2967707#L2948
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71083db7-377b-47a1-ac8b-83d8974a2654?source=cve
