What is the CVSS score of CVE-2026-40790?

CVE-2026-40790 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP SMS CVE-2026-40790

EUVD-2026-36993 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-15 Patchstack

GHSA-3rq6-78wc-q47c

Information Disclosure Wp Sms

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable WordPress endpoint exploitable by any subscriber-level account; read-only impact with no integrity or availability consequence justifies C:H/I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:08 vuln.today

DescriptionCVE.org

Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.

AnalysisAI

Sensitive SMS subscriber data exposure in the VeronaLabs WP SMS WordPress plugin (versions <= 7.2.1) permits authenticated subscriber-role users to access protected data through an authorization bypass path. The flaw, classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), enables the lowest-privilege WordPress account tier to retrieve sensitive information - likely including phone numbers, message history, or subscriber records - that should be restricted to privileged roles. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV, though the low attack complexity combined with open WordPress registration on many sites meaningfully lowers the real-world exploitation barrier.

Technical ContextAI

WP SMS is a WordPress plugin by VeronaLabs (CPE: cpe:2.3:a:veronalabs:wp_sms:*:*:*:*:*:*:*:*) used for SMS marketing, subscriber management, and notification delivery within WordPress installations. The root cause is CWE-288 - Authentication Bypass Using an Alternate Path or Channel - meaning the plugin exposes a route (likely a REST API endpoint, AJAX handler, or admin-ajax action) that circumvents the WordPress capability-check system ordinarily enforced for privileged data access. WordPress's subscriber role is the lowest-privilege authenticated tier, typically auto-assigned to users who register on public-facing sites. By exploiting the alternate path, a subscriber bypasses the intended role-gating and gains read access to sensitive SMS data. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms this is a network-reachable, low-complexity, read-only exploit with high confidentiality impact and no scope change to adjacent systems.

RemediationAI

Patch available per vendor advisory - administrators should update WP SMS beyond version 7.2.1 immediately; the exact remediation version is not independently confirmed in the available input data and should be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-sms/vulnerability/wordpress-wp-sms-plugin-7-2-1-sensitive-data-exposure-vulnerability before upgrading. As an interim compensating control for sites that cannot patch immediately, disabling open WordPress user registration (Settings > General > uncheck 'Anyone can register') closes the self-registration attack path for external actors, though it does not protect against insider threats or existing subscriber accounts and will prevent new public registrations. Auditing existing subscriber-role user accounts for unauthorized entries is also advisable. Temporarily deactivating the WP SMS plugin eliminates the vulnerable attack surface entirely but suspends all SMS functionality. Do not rely on network-perimeter controls alone, as PR:L exploitation requires only a valid session token accessible over standard HTTPS.