SSL Wireless SMS CVE-2026-96228

Exploitation requires that the target WordPress account has the sslcare_login_phone user meta set (i.e. the account was linked to a phone number through this plugin) and that the attacker knows that phone number. Both the otp_login_ajax_action and final_login_ajax_action handlers are public/unauthenticated AJAX endpoints, and the finalize step validates only the attacker-supplied phone and cap_data against the wp_sslcare_otp table, with no SMS OTP check and no server-side single-use state - so no credentials, OTP, or user interaction are needed. Limiting factors: only accounts that enrolled a phone via this plugin are targetable, the plugin must be installed and active, and the attacker must first know (or enumerate) the victim's phone number; impact escalates to full site compromise only when the targeted phone-linked account is an administrator.

This is a genuine high-priority authentication bypass despite the moderate 8.1 base score. The published CVSS vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) rates it network-reachable and unauthenticated, but the AC:H rating conflicts with the description, which states the finalize step 'trivially matches' - there is no race, timing, or attacker-uncontrolled condition described, so the real attack complexity is low and the effective severity is closer to critical. The vuln.today decision label is 'this_week' and the finding is reported by Wordfence, indicating a credible, prioritized issue. No EPSS score, SSVC decision, or KEV listing is provided in the input, and no CISA KEV entry exists, so there is no confirmation of active exploitation - treat urgency as 'patch this week' per the decision label rather than emergency. No public exploit code is identified in the references (they are a vendor advisory and the plugin source), so exploitation is currently theoretical-but-trivial: the logic flaw is fully described and easy to reproduce, which typically shortens time-to-exploit for a WordPress plugin bug. The main mitigating factor is footprint, not difficulty - this is a niche SMS-gateway plugin, so widespread mass exploitation is less likely than opportunistic targeting of sites that run it.

An unauthenticated attacker who knows the phone number of a phone-linked WordPress user (ideally an administrator) first calls the public otp_login_ajax_action endpoint with an attacker-chosen cap_data value, which writes a matching row to the wp_sslcare_otp table before any SMS is sent. The attacker then calls the public final_login_ajax_action handler, which matches that row on phone plus cap_data alone - never verifying the SMS OTP - and issues a valid authenticated session, completing account takeover. No public exploit code is identified at time of analysis, but the flaw is fully described and trivial to reproduce.