{"id":"CVE-2026-106007","kind":"vulnerability","aliases":["CVE-2026-106007"],"related":[],"title":"FraudLabs Pro SMS Verification WordPress plugin: unlimited SMS sends drain paid credits","description":"The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.","summary":"The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS retry limit on the server, so unauthenticated visitors can trigger unlimited verification texts. An attacker can exhaust the site owner's paid SMS credits and send spam to arbitrary phone numbers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FraudLabs Pro SMS Verification","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","sms","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `FraudLabs Pro SMS Verification` plugin is installed and its version is `1.12.1` or earlier in the WordPress plugins list","fix":null,"status":"open","published_at":"2026-11-10T09:17:21+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:27+00:00","updated_at":"2026-11-10T09:21:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T09:21:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FraudLabs Pro SMS Verification WordPress plugin: unlimited SMS sends drain paid credits","impact":"low","summary":"The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS retry limit on the server, so unauthenticated visitors can trigger unlimited verification texts. An attacker can exhaust the site owner's paid SMS credits and send spam to arbitrary phone numbers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","sms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers drain paid SMS credits and send spam texts","analyst_note":"Check the plugin's WordPress.org page or vendor advisory for a fixed version and whether a setting limits the retry count.","how_to_check":"- Check whether the `FraudLabs Pro SMS Verification` plugin is installed and its version is `1.12.1` or earlier in the WordPress plugins list\n- unknown for whether a fixed version exists","plain_action":"","product_name":"FraudLabs Pro SMS Verification","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FraudLabs Pro SMS Verification plugin version 1.12.1 or earlier are exposed, because the SMS retry limit is only enforced in the browser. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a configuration change limits exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4583,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106007':15A,18A '-2026':14A,17A '1.12.1':37B,82C 'allow':95C 'arbitrari':71B,123C 'attack':57B,109C 'attacker-chosen':108C 'chosen':110C 'credit':12A,66B,120C 'cve':13A,16A 'drain':10A 'enforc':40B,85C 'exhaust':59B,113C 'fraudlab':1A,30B,75C 'fraudlabs':19A 'limit':44B,90C 'messag':106C 'number':73B,102C,112C 'owner':62B,116C 'packag':23B 'paid':11A,64B,118C 'parti':125C 'phone':72B,111C 'plugin':6A,28B,35B,80C 'pro':2A,20A,31B,76C 'retri':43B,89C 'send':9A,68B,99C 'server':47B,93C 'side':94C 'site':61B,115C 'sms':3A,8A,21A,24B,32B,42B,65B,77C,88C,105C,119C 'sms-retri':87C 'spam':69B,122C 'text':55B 'third':124C 'trigger':52B 'unauthent':49B,96C 'unlimit':7A,53B,101C 'user':97C 'verif':4A,33B,54B,78C,104C 'verification':22A 'visitor':50B 'wordpress':5A,25B,27B,34B,79C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FraudLabs Pro SMS Verification plugin version 1.12.1 or earlier are exposed, because the SMS retry limit is only enforced in the browser. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a configuration change limits exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fraudlabsprosmsverification","prosmsverification"],"ptokens":["fraudlabs","pro","sms","verification"],"labels":["medium","package","sms","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-106007':15A,18A '-2026':14A,17A 'credit':12A 'cve':13A,16A 'drain':10A 'fraudlab':1A 'fraudlabs':19A 'paid':11A 'plugin':6A 'pro':2A,20A 'send':9A 'sms':3A,8A,21A 'unlimit':7A 'verif':4A 'verification':22A 'wordpress':5A","search_b":"'1.12.1':37B 'arbitrari':71B 'attack':57B 'credit':66B 'enforc':40B 'exhaust':59B 'fraudlab':30B 'limit':44B 'number':73B 'owner':62B 'packag':23B 'paid':64B 'phone':72B 'plugin':28B,35B 'pro':31B 'retri':43B 'send':68B 'server':47B 'site':61B 'sms':24B,32B,42B,65B 'spam':69B 'text':55B 'trigger':52B 'unauthent':49B 'unlimit':53B 'verif':33B,54B 'visitor':50B 'wordpress':25B,27B,34B 'wordpress-plugin':26B","search_c":"'1.12.1':82C 'allow':95C 'arbitrari':123C 'attack':109C 'attacker-chosen':108C 'chosen':110C 'credit':120C 'enforc':85C 'exhaust':113C 'fraudlab':75C 'limit':90C 'messag':106C 'number':102C,112C 'owner':116C 'paid':118C 'parti':125C 'phone':111C 'plugin':80C 'pro':76C 'retri':89C 'send':99C 'server':93C 'side':94C 'site':115C 'sms':77C,88C,105C,119C 'sms-retri':87C 'spam':122C 'third':124C 'unauthent':96C 'unlimit':101C 'user':97C 'verif':78C,104C 'wordpress':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106007","severity":null,"published_at":"2026-11-10T09:17:21+00:00","modified_at":"2026-11-10T09:17:21+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}