CVE-2026-13741 is a privilege escalation vulnerability in the Digits: WordPress Mobile Number Signup and Login plugin caused by improper privilege management (CWE-269). The vulnerability arises from a lack of authorization and role validation in the dig_update_wpwc_custom_fields() function, allowing authenticated users with Subscriber-level or higher privileges to escalate to Administrator by manipulating the digits_reg_userrole parameter during profile updates. This affects all plugin versions up to and including 9.1.0.5.

Successful exploitation allows an authenticated user with Subscriber-level access or above to gain Administrator privileges on the affected WordPress site. This leads to full control over the site, including the ability to modify content, install plugins, and change configurations, resulting in a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling the DIGITS User Role field to prevent exploitation or restrict profile update capabilities to trusted users only.