Authentication vulnerability in Login with phone number 1.7.34

The Login with phone number plugin for WordPress has a security vulnerability that allows unauthorized users to reset passwords without permission. This can happen in versions 1.7.34 and below. The problem is caused by the plugin creating a weak reset code and not having any limits on how many times the code can be used. This means that anyone without proper access can potentially change the password of any user by guessing a simple 6-digit code.