Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96228— SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover

Quick assessment

Affected
sslplugins SSL Wireless SMS Notification
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"SSL Wireless SMS Notification"在 3.8.1 及以下所有版本中存在身份验证绕过漏洞。该插件的公开处理函数 仅根据攻击者提供的电话号码和 字段，在 表中匹配记录，进而解析用户并创建已认证会话，却未验证短信一次性密码（OTP）或任何服务端的一次性状态。由于 是在公开的 步骤中由攻击者自行选择（该步骤在发送短信前已存储对应记录），因此最终化步骤能够轻易匹配成功，系统仅依据 用户元数据查找并登录用户。这使得未认证的攻击者只要知晓与用户账户绑定的电话号码，即可接管该账户

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96228

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
Source: CVE Program / CVE List V5
Vulnerability Description
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sslplugins SSL Wireless SMS Notification 0 ~ 3.8.1 -

II. Public POCs for CVE-2026-96228

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96228

请登录查看更多情报信息。

Other References for CVE-2026-96228 (3)

IV. Related Vulnerabilities

Same product: SSL Wireless SMS Notification
Same vendor: sslplugins
Same weakness: CWE-287