CVE-2026-106008: FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

Q: Which deployments are affected?

FraudLabs Pro SMS Verification versions 1.11.2 through 1.12.1 are affected. The issue applies where the plugin is used to enforce SMS verification on WooCommerce orders.

Q: Does an attacker need an account or a completed SMS verification to exploit this?

No. The vulnerability is exploitable by unauthenticated users and allows them to mark an order's SMS verification state as completed without validity checks.

Q: What is the practical impact of successful exploitation?

An attacker can forge the verified status of a WooCommerce order, bypassing the plugin's SMS verification control. The provided data identifies an integrity impact and does not identify confidentiality or availability impact.

Published Nov 9, 2026

Updated

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.

Affected Software

1 affected component

FraudLabs Pro SMS Verification>=1.11.2<=1.12.1

Event History

Nov 9, 2026

CVE Published

via MITRE·10:24 AM

Data Sourced

via MITRE·10:24 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

FraudLabs Pro SMS Verification versions 1.11.2 through 1.12.1 are affected. The issue applies where the plugin is used to enforce SMS verification on WooCommerce orders.

Does an attacker need an account or a completed SMS verification to exploit this?

No. The vulnerability is exploitable by unauthenticated users and allows them to mark an order's SMS verification state as completed without validity checks.

What is the practical impact of successful exploitation?

An attacker can forge the verified status of a WooCommerce order, bypassing the plugin's SMS verification control. The provided data identifies an integrity impact and does not identify confidentiality or availability impact.

CVE-2026-106008: FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or a completed SMS verification to exploit this?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or a completed SMS verification to exploit this?

What is the practical impact of successful exploitation?