WP SMS EUVD-2026-36993

Exploitation requires a valid WordPress user account at the subscriber role or higher on a site running WP SMS version 7.2.1 or earlier. On sites with open WordPress user registration enabled (the WordPress default for many blog and community configurations), any unauthenticated internet user can self-register to obtain the subscriber role, effectively making the attack externally accessible with no prior relationship to the target. Sites with closed user registration (registration disabled or invite-only) limit exploitation to internal users or existing account holders, significantly reducing external risk. The vulnerability is strictly read-only (C:H/I:N/A:N) - no write access, code execution, or service disruption is possible through this flaw. Exploitation is further limited to the specific data held by the WP SMS plugin, not the broader WordPress database or system.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the primary risk driver: high confidentiality impact accessible over the network with minimal complexity, constrained only by the need for a subscriber-level account. On WordPress sites with open user registration - a common default - this PR:L requirement is effectively nullified for external attackers, since anyone can self-register to obtain the subscriber role. This contextual factor elevates practical exploitability well beyond what the raw score conveys for open-registration deployments. No EPSS score was provided in the input data, preventing probabilistic exploitation forecasting. The absence of a KEV listing and no identified public exploit code suggest this vulnerability has not yet attracted broad automated exploitation campaigns. The confidentiality-only impact (I:N/A:N) limits the blast radius to data theft - primarily SMS subscriber PII such as phone numbers - with no destructive or persistence capability exposed. Sites subject to GDPR, CCPA, or telecom-adjacent privacy regulations face elevated compliance risk from such exposure beyond the technical CVSS score alone. The overall risk priority is moderate-to-high for open-registration WordPress sites running WP SMS with sensitive subscriber data; low for closed-registration or low-subscriber-count installations.

An attacker registers a free WordPress subscriber account on a target site with open user registration enabled, then issues a crafted HTTP request - likely a REST API call or AJAX request - to a WP SMS endpoint that lacks proper capability checks, exploiting the CWE-288 alternate authorization path. The server responds with sensitive SMS subscriber data including phone numbers and potentially message content, without any further privilege escalation required. No public exploit code has been identified at time of analysis, though the low attack complexity means any authenticated user familiar with WordPress API structures could reproduce the behavior without specialized tooling.