Authorization Bypass in FraudLabs Pro SMS Verification Plugin for WooCommerce
CVE-2026-106008

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Fraudlabs Pro Sms Verification
Vendor
CVE Published:
9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106008?

The FraudLabs Pro SMS Verification plugin for WordPress, specifically versions 1.11.2 to 1.12.1, exhibits a vulnerability that allows unauthorized users to bypass the SMS verification mechanism. This occurs because the plugin fails to conduct proper authorization and validity checks before confirming the SMS verification for WooCommerce orders. As a result, malicious actors can manipulate the verification status of orders, leading to potential fraud and exploitation of the system.

Affected Version(s)

FraudLabs Pro SMS Verification 1.11.2 <= 1.12.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106008 - Proof of Concept

References

https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • đź‘ľ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
WPScan
.