CVE-2023-23492

What it actually does

The described flaw is an authenticated SQL injection in the Login with Phone Number WordPress plugin before version 1.4.2, reachable through the lwp_forgot_password action via the ID parameter. Because the vulnerable parameter is incorporated into a database query without sufficient validation or parameterization, a low-privileged authenticated user can alter query logic. Successful exploitation can expose sensitive database contents, modify application data, and potentially affect site availability depending on database privileges and query behavior. The supplied package data also lists Debian/OpenStack packages with fixed versions; organizations should validate whether their scanner/feed mapping applies to the WordPress plugin issue, the listed distribution packages, or both before closing remediation.

Why it matters to the business

An attacker with any valid account could use the vulnerable password-recovery workflow to tamper with or extract data from the application database, creating risk of account compromise, data disclosure, service disruption, and loss of trust. The issue is high severity, has weaponized exploit maturity, has a high EPSS likelihood score of 0.57123, and has been public for more than three years, which increases the urgency for remaining exposed systems even though it is not currently listed in CISA KEV and is not flagged as ransomware-associated.

How an attack unfolds

An attacker first obtains or creates a low-privileged authenticated account on a vulnerable WordPress site using the affected Login with Phone Number plugin. The attacker then sends a request to the plugin's forgot-password action and places SQL-control input in the ID parameter. If the site is running a vulnerable version, the backend database query is modified by the attacker's input. The attacker can then use the response behavior, errors, timing differences, or returned data to infer database contents, extract sensitive records, modify data, or disrupt the application. In mature attacks, this may be chained with credential theft, password reset abuse, administrative account takeover, or further WordPress compromise.

How to fix it

Upgrade the Login with Phone Number WordPress plugin to version 1.4.2 or later. If the affected asset inventory is based on the provided Debian/OpenStack package mapping, update to the listed fixed package versions as applicable: nova on Debian 11 to 2:22.0.1-2+deb11u1, nova on Debian 12/13 to 2:26.0.0-6, glance on Debian 11 to 2:21.0.0-2+deb11u1, glance on Debian 12/13 to 2:25.0.0-2, cinder on Debian 11 to 2:17.0.1-1+deb11u1, cinder on Debian 12 to 2:21.0.0-3, and openstack/nova Git deployments to commit a5ce4d806172f9d144633f297163e088c8ed1491 or later. Where immediate upgrade is not possible, disable the vulnerable plugin/functionality, restrict access to authenticated workflows, block suspicious requests to the affected action at the WAF, and ensure the application database user has the minimum privileges required. Also review exposed user registration and password-reset flows, because the vulnerability requires authentication but may still be reachable by self-registered users.

How to confirm the fix worked

Confirm that the Login with Phone Number plugin reports version 1.4.2 or later, or that the relevant Debian/OpenStack packages are at or above the fixed versions listed for the deployed distribution. Verify that the vulnerable lwp_forgot_password action no longer accepts SQL-control input in the ID parameter by using a safe, authorized test in a staging environment and confirming that input is treated as data, not query syntax. Review WordPress plugin inventories, package manager output, container images, SBOMs, and vulnerability scanner results to ensure no stale plugin copies or old packages remain. After patching, confirm normal forgot-password behavior still works and that web server, PHP, and database logs do not show new SQL errors or suspicious requests to the affected endpoint.

Typical attack path

1. Identify a WordPress site using the Login with Phone Number plugin or discover the plugin path through web content enumeration.
2. Authenticate with an existing low-privileged account or create one if registration is open.
3. Send requests to the lwp_forgot_password action with crafted input in the ID parameter.
4. Observe database errors, response differences, timing behavior, or returned content to confirm SQL injection.
5. Use the injection condition to enumerate database metadata and extract sensitive application data.
6. Attempt to modify account records, password-reset state, or other database-backed application data if database permissions allow.
7. Pivot to administrative access or deploy additional persistence if credentials or privileged session material are obtained.

How to detect it

To determine whether exploitation already occurred, review web server access logs, WordPress application logs, PHP error logs, WAF events, and database query/error logs for requests to the plugin's forgot-password action containing SQL injection patterns in the ID parameter. Focus on POST or GET traffic to WordPress AJAX endpoints, especially /wp-admin/admin-ajax.php with action=lwp_forgot_password. Look for database error messages, abnormal response sizes, repeated requests with small parameter changes, timing-based probes, and use of common SQL keywords or functions in parameters. Correlate suspicious requests with WordPress authentication logs, newly created accounts, password-reset activity, privilege changes, unexpected administrator logins, and database changes around the same timestamps. If compromise is suspected, preserve logs, capture the affected plugin version, review database integrity, rotate credentials, and inspect the web root for newly modified PHP files or web shells.

• action=lwp_forgot_password
• lwp_forgot_password
• /wp-admin/admin-ajax.php
• /wp-content/plugins/login-with-phone-number/
• ID=
• UNION SELECT
• UNION%20SELECT
• SLEEP(
• BENCHMARK(
• OR 1=1
• OR%201%3D1
• information_schema
• You have an error in your SQL syntax
• SQL syntax
• mysql_fetch
• mysqli_sql_exception
• PDOException
• database error

What your security team should do

• Prioritize remediation because exploitation is weaponized, the EPSS probability is high, and the issue has been public for a long time.
• Inventory all WordPress sites for the Login with Phone Number plugin and verify plugin version 1.4.2 or later.
• If scanner output references the listed Debian/OpenStack packages, validate the product mapping and apply the exact fixed package versions where applicable.
• Temporarily disable the plugin or restrict the forgot-password action if patching cannot be completed quickly.
• Search historical web, PHP, WordPress, WAF, and database logs for requests to lwp_forgot_password with suspicious ID parameter values.
• Review recently changed WordPress administrator accounts, password reset activity, unexpected user creation, and database modifications.
• Apply least-privilege database permissions for the application account to limit post-exploitation impact.
• Add WAF/SIEM detections for SQL injection patterns targeting wp-admin/admin-ajax.php and the lwp_forgot_password action.