Authentication bypass in SSL Wireless SMS Notification enables account takeover
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
SSL Wireless SMS Notification for WordPress, in all versions up to and including 3.8.1, contains an authentication bypass (CWE-287). The public final_login_ajax_action handler logs in a user by matching only the attacker-supplied phone number and a value the attacker chose earlier, without checking the SMS one-time password. An unauthenticated attacker who knows a phone-linked user's number can take over that account.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sslplugins | SSL Wireless SMS Notification | up to 3.8.1 | — | No fix listed | CNA |
- SSL Wireless SMS Notification Vendorsslplugins Affected up to 3.8.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for SSL Wireless SMS Notification.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-29 Threatist record created from CVE-2026-96228
- 2026-10-29 Alias added: GHSA-qmqg-vj89-8937
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4947d5-91f3-4b36-b309-7c52c483be3d?source=cve
- https://plugins.svn.wordpress.org/ssl-wireless-sms-notification/tags/3.8.1/sslWireless.php
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ssl-wireless-sms-notification/ssl-wireless-sms-notification-360-unauthenticated-privilege-escalation
More sslplugins vulnerabilities
- TI-2024-37253 WordPress SSL Wireless SMS Notification Plugin <= 3.5.0 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2024-37190 WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-96228 · CVE Program
- CVE-2026-96228 · NVD
- FIRST EPSS
- GHSA-qmqg-vj89-8937 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences