Ssl Wireless Sms Notification
Monthly
Authentication bypass in the SSL Wireless SMS Notification plugin for WordPress (all versions through 3.8.1) lets unauthenticated remote attackers take over any account that has a phone number linked via the plugin's sslcare_login_phone user meta, by calling the public final_login_ajax_action handler with a matching phone and attacker-chosen cap_data - the handler issues an authenticated session without verifying the SMS OTP or any server-side single-use state. Exploitation requires that the target account enrolled a phone through this plugin and that the attacker knows that phone number; impact escalates to full site compromise when the targeted account is an administrator. No public exploit code has been identified at time of analysis, and the issue is prioritized for remediation this week.
Authentication bypass in the SSL Wireless SMS Notification plugin for WordPress (all versions through 3.8.1) lets unauthenticated remote attackers take over any account that has a phone number linked via the plugin's sslcare_login_phone user meta, by calling the public final_login_ajax_action handler with a matching phone and attacker-chosen cap_data - the handler issues an authenticated session without verifying the SMS OTP or any server-side single-use state. Exploitation requires that the target account enrolled a phone through this plugin and that the attacker knows that phone number; impact escalates to full site compromise when the targeted account is an administrator. No public exploit code has been identified at time of analysis, and the issue is prioritized for remediation this week.