CVE-2024-6482 is a critical privilege escalation vulnerability in the 'Login with phone number' WordPress plugin developed by glboy. The vulnerability stems from CWE-269: Improper Privilege Management, specifically a lack of validation and missing capability checks on user-supplied data within the 'lwp_update_password_action' function. This function handles password updates but fails to verify whether the requesting user has the appropriate permissions to change their user role. As a result, any authenticated user with at least Subscriber-level access can manipulate the function to elevate their privileges to any role, including Administrator. This effectively allows attackers to gain full control over the WordPress site. The vulnerability affects all plugin versions up to and including 1.7.49. A partial patch was introduced in version 1.7.40, but exploitation is still possible in versions 1.7.40 through 1.7.49 if the Pro plugin is installed. No authentication bypass or user interaction is required beyond having a valid Subscriber or higher account. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction needed. There are no known public exploits in the wild at this time, but the ease of exploitation and potential impact make it a significant threat to WordPress sites using this plugin.

The vulnerability allows attackers with minimal privileges (Subscriber-level) to escalate their access to Administrator, granting full control over the affected WordPress site. This can lead to complete site takeover, including the ability to install malicious plugins, modify content, steal sensitive data, and disrupt site availability. The compromise of administrator accounts can also facilitate further lateral movement within an organization's network if the WordPress site is integrated with internal systems. Given WordPress's widespread use globally, sites using this plugin are at risk of severe confidentiality, integrity, and availability breaches. The lack of user interaction and low complexity of exploitation increase the likelihood of attacks once the vulnerability is known. Organizations relying on this plugin for user authentication via phone numbers face a critical risk that could undermine their entire web presence and trustworthiness.

1. Immediately update the 'Login with phone number' plugin to a version later than 1.7.49 once a fixed release is available. 2. If an update is not yet available, disable the plugin or the vulnerable functionality to prevent exploitation. 3. Implement strict access control policies to restrict Subscriber-level accounts from accessing password update functions or role modification endpoints. 4. Monitor WordPress user role changes and audit logs for suspicious privilege escalations. 5. Employ Web Application Firewalls (WAFs) with custom rules to detect and block attempts to exploit the 'lwp_update_password_action' function. 6. Limit the installation of the Pro plugin to trusted users only, as it is required for exploitation in certain versions. 7. Educate site administrators on the risks of privilege escalation and encourage regular security reviews of user roles and plugin updates. 8. Consider additional hardening measures such as two-factor authentication and least privilege principles for all user accounts.