CVE-2026-96228

Name of the Vulnerable Software and Affected Versions SSL Wireless SMS Notification for WordPress versions prior to 3.8.2

Description An authentication bypass exists where the final login ajax action handler issues an authenticated session by matching the wp sslcare otp table using only the attacker-supplied phone and cap data variables. The system fails to verify the SMS OTP or any server-side single-use state. Since the cap data is selected by the attacker during the otp login ajax action step, the finalization process matches the data and identifies the user based solely on the sslcare login phone meta. This allows unauthenticated attackers who possess a phone number linked to a user to take over that account.

Recommendations Update SSL Wireless SMS Notification for WordPress to version 3.8.2 or later.