{"id":"CVE-2026-96228","kind":"vulnerability","aliases":["CVE-2026-96228"],"related":[],"title":"WordPress SSL Wireless SMS plugin: unauthenticated login as any phone-linked user","description":"SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.","summary":"The SSL Wireless SMS Notification plugin for WordPress, versions up to and including 3.8.1, skips checking the SMS one-time code when finishing a phone login. An unauthenticated attacker who knows a user's linked phone number can get a logged-in session as that user.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ssl-wireless-sms-notification","fixed":[],"affected":"<= 3.8.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-bypass","package","self-hosted","ssl-wireless-sms","woocommerce","wordpress"],"not_affected_if":["otp-login-disabled","plugin-above-3.8.1","plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: look for 'SSL Wireless SMS Notification' (slug ssl-wireless-sms-notification) at version 3.8.1 or lower; or run: wp plugin list --name=ssl-wireless-sms-notification. Exposed only if the OTP Login feature is used (phone numbers linked to users).","fix":null,"status":"open","published_at":"2026-10-29T04:18:45+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","triaged_at":"2026-10-29T04:42:59+00:00","updated_at":"2026-10-29T04:44:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T04:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress SSL Wireless SMS plugin: unauthenticated login as any phone-linked user","impact":"high","summary":"The SSL Wireless SMS Notification plugin for WordPress, versions up to and including 3.8.1, skips checking the SMS one-time code when finishing a phone login. An unauthenticated attacker who knows a user's linked phone number can get a logged-in session as that user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ssl-wireless-sms","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any phone-linked WordPress user","analyst_note":"Confirm whether a fixed plugin version exists and the exact check for the plugin in the WordPress install, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96228.","how_to_check":"- Check whether the plugin \"SSL Wireless SMS Notification\" is installed and its version is `3.8.1` or lower in the WordPress admin plugins list\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-3.8.1"],"who_is_affected":"Sites running the SSL Wireless SMS Notification plugin at version 3.8.1 or earlier that use phone-based login linked to user accounts are exposed, since the flaw is in the login handler itself. Sites without the plugin, or with it removed, are not affected. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4269,"output_tokens":599,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed plugin version exists and the exact check for the plugin in the WordPress install, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96228.","search":"'-2026':15A,18A '-96228':16A,19A '3.8.1':51B,104C 'account':213C 'action':110C,165C 'ajax':109C,164C 'attack':67B,131C,158C,199C 'attacker-suppli':130C 'auth':26B 'auth-bypass':25B 'authent':95C,118C 'bypass':27B,96C 'cap':135C,152C 'check':53B 'chosen':155C 'code':59B 'cve':14A,17A 'data':136C,153C 'final':107C,176C 'finish':61B 'get':77B 'handler':111C 'host':31B 'includ':50B,103C 'issu':116C 'know':69B,201C 'link':12A,73B,205C 'log':80B 'logged-in':79B 'login':7A,64B,108C,163C,190C 'look':184C 'make':194C 'match':121C,179C 'meta':192C 'notif':42B,89C 'notification':24A 'number':75B,208C 'one':57B 'one-tim':56B 'otp':125C,141C,162C 'packag':28B 'phone':11A,63B,74B,133C,191C,204C 'phone-link':10A,203C 'plugin':5A,43B 'possibl':196C 'public':106C,161C 'resolv':112C 'row':170C 'self':30B 'self-host':29B 'send':172C 'server':145C 'server-sid':144C 'session':82B,119C 'side':146C 'singl':148C 'single-us':147C 'skip':52B 'sms':4A,23A,35B,41B,55B,88C,140C,174C 'sole':186C 'ssl':2A,21A,33B,39B,86C 'ssl-wireless-sm':32B 'ssl-wireless-sms-notification':20A 'sslcare':124C,189C 'state':150C 'step':166C,177C 'store':168C 'suppli':132C 'tabl':126C 'take':210C 'time':58B 'trivial':178C 'unauthent':6A,66B,198C 'use':149C 'user':13A,71B,85B,114C,182C,206C 'verifi':138C 'version':46B,99C 'vulner':93C 'wireless':3A,22A,34B,40B,87C 'without':137C 'woocommerc':36B 'wordpress':1A,37B,45B,91C 'wp':123C","nicknames":[],"mitigations":[],"who_affected":"Sites running the SSL Wireless SMS Notification plugin at version 3.8.1 or earlier that use phone-based login linked to user accounts are exposed, since the flaw is in the login handler itself. Sites without the plugin, or with it removed, are not affected. The sources do not state a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T04:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96228","severity":null,"published_at":"2026-10-29T04:18:45+00:00","modified_at":"2026-10-29T04:18:45+00:00","first_seen_at":"2026-10-29T04:41:58+00:00","fetched_at":"2026-10-29T04:41:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96228:996","url":null,"severity":null,"published_at":"2026-10-29T04:44:28+00:00","modified_at":"2026-10-29T04:44:28+00:00","first_seen_at":"2026-10-29T04:44:28+00:00","fetched_at":"2026-10-29T04:44:28+00:00","note":"No fixed version found. WordPress.org directory (vendor page) lists 3.8.1 as latest release, last updated May 2025, with no 3.8.2+; page does not itself say 'no fix', so fix left unknown. Wordfence-assigned CVSS 8.1 (AV:N/AC:H); detail via notcve. NVD page returned no text. No exploitation or PoC seen. Nothing verified: no Wordfence/maintainer advisory read."}],"documents":[{"id":14259,"url":"https://wordpress.org/plugins/ssl-wireless-sms-notification/","title":"SSL Wireless SMS Notification - WordPress.org plugin directory (latest 3.8.1)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":14260,"url":"https://notcve.org/cve/CVE-2026-96228","title":"notcve: CVE-2026-96228 (Wordfence CVSS 8.1)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}