CVE-2025-10484

The record

The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.

Affected packages

Related vulnerabilities

• CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
• CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
• CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
• CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
• CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
• CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
• CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288
• CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. CWE-288