{"id":"CVE-2026-106008","kind":"vulnerability","aliases":["CVE-2026-106008"],"related":[],"title":"FraudLabs Pro SMS Verification WordPress plugin: unauthenticated order verification bypass","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","summary":"The FraudLabs Pro SMS Verification plugin for WordPress, versions 1.11.2 through 1.12.1, does not check authorisation or validity before marking a WooCommerce order's SMS verification as completed. An unauthenticated visitor can forge the verified state of an order and skip the plugin's SMS check.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fraudlabs-pro-sms-verification","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-outside-range"],"how_to_check":"- Look for the FraudLabs Pro SMS Verification plugin in the WordPress plugins list and note its version.\n- Confirm whether the installed version is between `1.11.2` and `1.12.1` inclusive.","fix":null,"status":"open","published_at":"2026-11-09T11:17:18+00:00","first_seen_at":"2026-11-09T11:26:02+00:00","triaged_at":"2026-11-09T11:26:48+00:00","updated_at":"2026-11-09T11:26:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FraudLabs Pro SMS Verification WordPress plugin: unauthenticated order verification bypass","impact":"medium","summary":"The FraudLabs Pro SMS Verification plugin for WordPress, versions 1.11.2 through 1.12.1, does not check authorisation or validity before marking a WooCommerce order's SMS verification as completed. An unauthenticated visitor can forge the verified state of an order and skip the plugin's SMS check.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","fraudlabs-pro-sms-verification"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker bypasses SMS verification on WooCommerce orders","analyst_note":"Confirm the fixed version and any vendor advisory for the FraudLabs Pro SMS Verification plugin; the NVD entry gives no fix.","how_to_check":"- Look for the FraudLabs Pro SMS Verification plugin in the WordPress plugins list and note its version.\n- Confirm whether the installed version is between `1.11.2` and `1.12.1` inclusive.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-outside-range"],"who_is_affected":"Sites running the FraudLabs Pro SMS Verification plugin in the affected version range with WooCommerce orders that rely on it for verification. Sites without the plugin, or on versions outside the range, are not affected. The sources do not say whether a fixed version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4576,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106008':13A,16A '-2026':12A,15A '1.11.2':34B,79C '1.12.1':36B,81C 'allow':99C 'authoris':40B,85C 'bypass':10A,111C 'check':39B,70B,88C 'complet':52B,98C 'control':117C 'cve':11A,14A 'forg':57B,103C 'fraudlab':1A,18B,26B,72C 'fraudlabs-pro-sms-verif':17B 'mark':44B,90C 'order':8A,47B,63B,93C,109C 'packag':22B 'perform':84C 'plugin':6A,30B,67B,77C,113C 'pro':2A,19B,27B,73C 'skip':65B 'sms':3A,20B,28B,49B,69B,74C,95C,115C 'state':60B,106C 'unauthent':7A,54B,100C 'user':101C 'valid':42B,87C 'verif':4A,9A,21B,29B,50B,75C,96C,116C 'verifi':59B,105C 'version':33B 'visitor':55B 'woocommerc':23B,46B,92C 'wordpress':5A,24B,32B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FraudLabs Pro SMS Verification plugin in the affected version range with WooCommerce orders that rely on it for verification. Sites without the plugin, or on versions outside the range, are not affected. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fraudlabsprosmsverification","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-106008':13A,16A '-2026':12A,15A 'bypass':10A 'cve':11A,14A 'fraudlab':1A 'order':8A 'plugin':6A 'pro':2A 'sms':3A 'unauthent':7A 'verif':4A,9A 'wordpress':5A","search_b":"'1.11.2':34B '1.12.1':36B 'authoris':40B 'check':39B,70B 'complet':52B 'forg':57B 'fraudlab':18B,26B 'fraudlabs-pro-sms-verif':17B 'mark':44B 'order':47B,63B 'packag':22B 'plugin':30B,67B 'pro':19B,27B 'skip':65B 'sms':20B,28B,49B,69B 'state':60B 'unauthent':54B 'valid':42B 'verif':21B,29B,50B 'verifi':59B 'version':33B 'visitor':55B 'woocommerc':23B,46B 'wordpress':24B,32B","search_c":"'1.11.2':79C '1.12.1':81C 'allow':99C 'authoris':85C 'bypass':111C 'check':88C 'complet':98C 'control':117C 'forg':103C 'fraudlab':72C 'mark':90C 'order':93C,109C 'perform':84C 'plugin':77C,113C 'pro':73C 'sms':74C,95C,115C 'state':106C 'unauthent':100C 'user':101C 'valid':87C 'verif':75C,96C,116C 'verifi':105C 'woocommerc':92C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106008","severity":null,"published_at":"2026-11-09T11:17:18+00:00","modified_at":"2026-11-09T11:17:18+00:00","first_seen_at":"2026-11-09T11:26:02+00:00","fetched_at":"2026-11-09T11:26:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}