FRAUDLABS PRO SMS VERIFICATION · CVE-2026-106007 · Package
NO FIX YET
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS retry limit on the server, so unauthenticated visitors can trigger unlimited verification texts. An attacker can exhaust the site owner's paid SMS credits and send spam to arbitrary phone numbers.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the FraudLabs Pro SMS Verification plugin version 1.12.1 or earlier are exposed, because the SMS retry limit is only enforced in the browser. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a configuration change limits exposure.
Not affected if plugin-not-installed
Who cares sms, wordpress, wordpress-plugin
FraudLabs Pro SMS Verification plugin is installed and its version is 1.12.1 or earlier in the WordPress plugins listNo fix yet, per the sources.
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.