Input validation vulnerability in Login with phone number 1.6.93

A plugin for WordPress called “Login with phone number” has a security issue in versions 1.6.93 and below. This problem is caused by a lack of proper security checks on two functions called lwp_forgot_password() and lwp_update_password_action(). This means that someone who is not logged in can change the passwords of other users if they can trick a site administrator into clicking on a certain link.