CVE-2026-96228 SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-96228?
CVE-2026-96228 is a high-severity vulnerability in sslplugins SSL Wireless SMS Notification, published on 29 Oct 2026.
Official description
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
Weakness: CWE-287
Which versions are affected by CVE-2026-96228?
How do I fix CVE-2026-96228?
No fix has been published for CVE-2026-96228 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-96228 being exploited?
There is no known exploitation of CVE-2026-96228 in the wild and no public exploit code.
Sources
Also known as GHSA-qmqg-vj89-8937.