Access violation vulnerability in Login with phone number 1.7.49

A security issue has been found in the Login with phone number plugin for WordPress. This vulnerability affects all versions up to and including 1.7.49. The problem is caused by a lack of proper checks on user-provided information in the ‘lwp_update_password_action’ function. As a result, attackers with at least Subscriber-level access can potentially update their role to gain Administrator privileges. The plugin was partially fixed in version 1.7.40, but versions 1.7.40 to 1.7.49 are still vulnerable.