CVE-2026-106007
FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.
| Vendor | unknown |
| Product | fraudlabs pro sms verification |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fraudlabs pro sms verification
Be the first to know when new medium vulnerabilities affecting unknown fraudlabs pro sms verification are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / FraudLabs Pro SMS Verification
0 ≤ 1.12.1
References
Credits
ryan fabella WPScan