Two-factor authentication bypass via profile phone overwrite

Authorization bypass in LMS Doctor Simple 2FA Plugin for Moodle allows remote authenticated users to replace the 2FA phone number via profile.php. The profile.php endpoint accepts and stores a replacement phone number after password validation but before the pending second factor has been confirmed. An attacker with valid account credentials can redirect the six-digit code to an attacker-controlled device and complete the login.