---
id: "CVE-2026-106007"
page: "https://infrastack.ai/live/CVE-2026-106007"
kind: "vulnerability"
aliases: ["CVE-2026-106007"]
title: "FraudLabs Pro SMS Verification WordPress plugin: unlimited SMS sends drain paid credits"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "FraudLabs Pro SMS Verification", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "sms", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-10T09:17:21+00:00"
first_seen_at: "2026-11-10T09:21:08+00:00"
updated_at: "2026-11-10T09:21:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106007", "first_seen_at": "2026-11-10T09:21:08+00:00"}]
exploit_sources: []
---

# FraudLabs Pro SMS Verification WordPress plugin: unlimited SMS sends drain paid credits

Link for people: https://infrastack.ai/live/CVE-2026-106007 (this .md is for agents)

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS retry limit on the server, so unauthenticated visitors can trigger unlimited verification texts. An attacker can exhaust the site owner's paid SMS credits and send spam to arbitrary phone numbers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FraudLabs Pro SMS Verification affected range not listed fixed no fixed version listed

## How to check

- Check whether the `FraudLabs Pro SMS Verification` plugin is installed and its version is `1.12.1` or earlier in the WordPress plugins list

## Timeline

- 2026-11-10T09:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106007

## From the sources

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_