Digits: WordPress Mobile Number Signup and Login vulnerabilities

2 known vulnerabilities in Digits: WordPress Mobile Number Signup and Login from UnitedOver. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Digits: WordPress Mobile Number Signup and Login: Improper Privilege Management

  CVE-2026-13741Jul 16, 2026UnitedOver

  The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` fun

• 8.8 High severity

  Digits: WordPress Mobile Number Signup and Login: Cross-Site Request Forgery

  CVE-2024-0203Mar 7, 2024UnitedOver

  The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify