CVE-2026-96228: SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public finalloginajaxaction handler resolves a user and issues an authenticated session by matching the wpsslcareotp table on only the attacker-supplied phone and capdata, without verifying the SMS OTP or any server-side single-use state. Because capdata was chosen by the attacker in the public otploginajaxaction step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcareloginphone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it if they know the phone number linked to a user account through the sslcare_login_phone user meta field. No valid WordPress account, SMS OTP, or user interaction is required.
What conditions must be present for an account to be at risk?
The affected plugin must be installed at version 3.8.1 or earlier, and the target account must have a phone number configured for this plugin's login flow. The attacker must know that phone number.
Does the attacker need to intercept SMS messages or know the one-time password?
No. The vulnerable login finalization handler does not verify the SMS OTP or enforce server-side single-use state. An attacker can supply their own cap_data value during the public login initiation step and use it to complete authentication.
How can administrators determine whether an account may have been exposed?
Review whether the plugin is installed at version 3.8.1 or earlier and identify user accounts with the sslcare_login_phone meta value configured. Those phone-linked accounts are the accounts implicated by the vulnerable authentication flow.