CVE-2025-10484

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10484", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-15T14:03:41.704Z", "datePublished": "2026-01-17T08:24:30.759Z", "dateUpdated": "2026-04-08T16:58:55.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:55.363Z"}, "affected": [{"vendor": "FmeAddons", "product": "Registration & Login with Mobile Phone Number for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password."}], "title": "Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=cve"}, {"url": "https://woocommerce.com/products/registration-login-with-mobile-phone-number/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Vahan Petrosyan"}], "timeline": [{"time": "2026-01-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T19:17:47.172522Z", "id": "CVE-2025-10484", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:23:24.113Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10484", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T19:17:47.172522Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T19:17:51.008Z"}}], "cna": {"title": "Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Vahan Petrosyan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "FmeAddons", "product": "Registration & Login with Mobile Phone Number for WooCommerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=cve"}, {"url": "https://woocommerce.com/products/registration-login-with-mobile-phone-number/"}], "descriptions": [{"lang": "en", "value": "The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-17T08:24:30.759Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10484", "state": "PUBLISHED", "dateUpdated": "2026-01-20T19:23:24.113Z", "dateReserved": "2025-09-15T14:03:41.704Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-17T08:24:30.759Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Registration & Login with Mobile Phone Number for WooCommerce", "vendor": "FmeAddons", "versions": [{"lessThanOrEqual": "1.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password."}, {"lang": "es", "value": "El plugin Registration &amp; Login with Mobile Phone Number para WooCommerce para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 1.3.1, inclusive. Esto se debe a que el plugin no verifica correctamente la identidad de un usuario antes de autenticarlo a trav\u00e9s de la funci\u00f3n fma_lwp_set_session_php_fun(). Esto hace posible que atacantes no autenticados se autentiquen como cualquier usuario del sitio, incluidos los administradores, sin una contrase\u00f1a v\u00e1lida."}], "id": "CVE-2025-10484", "lastModified": "2026-06-17T08:28:24.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10484", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T19:17:47.172522Z", "version": "2.0.3"}}]}, "published": "2026-01-17T09:15:50.303", "references": [{"source": "security@wordfence.com", "url": "https://woocommerce.com/products/registration-login-with-mobile-phone-number/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:51:38.507649+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 1.3.1 if an update is available. If no update exists, disable the mobile phone login feature or remove the plugin entirely. Implement multi\u2011factor authentication for all administrator accounts to add an additional barrier to takeover.", "Consider disabling or restricting the plugin\u2019s mobile phone authentication endpoints to prevent unauthorized access.", "Implement a monitoring solution to detect and alert on repeated failed authentication attempts or suspicious login activity."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the FmeAddons Registration & Login with Mobile Phone Number for WooCommerce plugin of version 1.3.1 or earlier is affected. The vulnerability applies to all plugin instances that rely on this authentication flow, regardless of site size or configuration.", "description_and_impact": "The Registration & Login with Mobile Phone Number for WooCommerce plugin is vulnerable to authentication bypass because it does not properly verify a user\u2019s identity before calling the fma_lwp_set_session_php_fun() function. As a result, an unauthenticated attacker can log in as any site user, including administrators, without needing a valid password, fully compromising account control.", "risk_and_exploitability": "The CVSS score of 9.8 demonstrates a critical risk to confidentiality, integrity, and availability. The EPSS score of less than 1% indicates that exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the authentication bypass could be triggered remotely through normal site interactions, allowing an attacker who can reach the site to authenticate without credentials and gain full administrative privileges."}}}}, "created": "2026-01-19T09:19:23.101766+00:00", "updated": "2026-04-22T14:00:18.228849+00:00", "vendors": ["fmeaddons", "fmeaddons$PRODUCT$registration_and_login_with_mobile_phone_number_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}