CVE-2026-96228
HIGH
MEDIUM
Priority: 0.00
BB Relevance:
66/100
Published: 2026-10-29
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| sslplugins | SSL Wireless SMS Notification | 0 |
| sslplugins | SSL Wireless SMS Notification | 0 |
| sslplugins | SSL Wireless SMS Notification | 0 |