Live › vulnerability › CVE-2026-96228
The SSL Wireless SMS Notification plugin for WordPress, versions up to and including 3.8.1, skips checking the SMS one-time code when finishing a phone login. An unauthenticated attacker who knows a user's linked phone number can get a logged-in session as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:41 UTC. All times on this page are UTC.
Sites running the SSL Wireless SMS Notification plugin at version 3.8.1 or earlier that use phone-based login linked to user accounts are exposed, since the flaw is in the login handler itself. Sites without the plugin, or with it removed, are not affected. The sources do not state a fixed version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ssl-wireless-sms-notification | wordpress | <= 3.8.1 | – |
SSL Wireless SMS Notification (slug ssl-wireless-sms-notification) at version 3.8.1 or lower; or run: wp plugin list --name=ssl-wireless-sms-notificationUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
This page as .md · .json · in your agent: get_signal("CVE-2026-96228")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.