Authentication Bypass Vulnerability in SSL Wireless SMS Notification for WordPress

CVE-2026-96228

What is CVE-2026-96228?

The SSL Wireless SMS Notification plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to bypass authentication mechanisms. Specifically, the final_login_ajax_action handler incorrectly resolves user accounts using only an attacker-supplied phone number and specific data. This occurs without validating the SMS One Time Password (OTP), enabling unauthorized access to user accounts. Attackers can exploit this weakness to take over accounts linked to the targeted phone number, leading to potential data breaches and unauthorized actions on behalf of the users.

References