CVE-2026-106008
FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.
| Vendor | unknown |
| Product | fraudlabs pro sms verification |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fraudlabs pro sms verification
Be the first to know when new medium vulnerabilities affecting unknown fraudlabs pro sms verification are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / FraudLabs Pro SMS Verification
1.11.2 ≤ 1.12.1
References
Credits
Pablo González Pérez Francisco José Ramírez Vicente Iñigo Sánchez Enciso WPScan