{"id":"CVE-2026-106008","aliases":["EUVD-2026-119933","GHSA-8r36-f247-525w"],"status":"published","title":"FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00314,"percentile":0.24649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-09T10:24:51Z","modified":"2026-11-09T13:51:55Z","products":[{"vendor":"fraudlabs pro","product":"fraudlabs pro sms verification"},{"vendor":"unknown","product":"fraudlabs pro sms verification"}],"references":[{"url":"https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106008"},{"url":"https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0"},{"url":"https://github.com/advisories/GHSA-8r36-f247-525w"}],"sources":{"cve":[{"id":"CVE-2026-106008","title":"FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","status":"published","published":"2026-11-09T10:24:51.108Z","modified":"2026-11-09T13:51:55.09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T14:33:34.013968Z"}],"euvd":[{"id":"EUVD-2026-119933","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","status":"published","published":"2026-11-09T10:24:51Z","modified":"2026-11-09T13:51:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T15:17:14.169746Z"}],"ghsa":[{"id":"GHSA-8r36-f247-525w","title":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform...","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","status":"published","published":"2026-11-09T12:31:42Z","modified":"2026-11-09T15:32:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T15:48:41.634645Z"}],"nvd":[{"id":"CVE-2026-106008","description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","status":"published","published":"2026-11-09T11:17:18.627Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-09T16:14:55.674086Z"}]}}