Vulnerability Description
The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://digits.unitedover.com/changelog/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/02a283b2-a369-4927-a54
FAQ
What is CVE-2026-13741?
CVE-2026-13741 is a vulnerability with a CVSS score of 8.8 (HIGH). The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and ...
How severe is CVE-2026-13741?
CVE-2026-13741 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-13741?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.