Executive Summary

A critical vulnerability (CVE-2026-96228) with a CVSS score of 8.1 has been discovered in the SSL Wireless SMS Notification WordPress plugin. This vulnerability allows unauthenticated attackers to bypass authentication and take over user accounts if they know the user's phone number. The plugin versions up to and including 3.8.1 are affected.

Technical Analysis

The vulnerability is an authentication bypass issue in the final_login_ajax_action handler of the SSL Wireless SMS Notification plugin. The handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table based on the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. The root cause is the lack of proper verification of SMS OTP and server-side single-use state, allowing attackers to take over accounts using only the phone number.

How It Gets Exploited

An unauthenticated remote attacker who knows a phone-linked user's number can exploit this vulnerability. The attacker would first use the otp_login_ajax_action step to store a chosen cap_data value before sending an SMS. Then, in the final_login_ajax_action step, the attacker supplies the phone number and the previously chosen cap_data, which trivially matches the stored row. As a result, the user is looked up solely by the sslcare_login_phone meta, allowing the attacker to take over the account without needing the actual SMS OTP.

Impact Assessment

The vulnerability affects all versions of the SSL Wireless SMS Notification plugin up to and including 3.8.1. Successful exploitation allows unauthenticated attackers to gain control of user accounts, potentially leading to unauthorized access to sensitive information and further exploitation. The CVSS score of 8.1 indicates a high severity level.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the SSL Wireless SMS Notification plugin to a version beyond 3.8.1 as soon as possible. Additionally, users should be cautious about using SMS-based authentication mechanisms and consider implementing more secure authentication methods. Monitoring for suspicious login attempts and implementing additional security measures such as two-factor authentication can also help reduce the risk.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence Threat Intel