CVE-2026-106008 in FraudLabs Pro SMS Verification Plugin
Summary
by MITRE • 11/09/2026
The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in FraudLabs Pro SMS Verification WordPress plugins versions 1.11.2 through 1.12.1 represents a critical failure in access control logic, specifically categorized under CWE-862 Missing Authorization and CWE-345 Insufficient Verification of Data Authenticity. This flaw allows unauthenticated actors to manipulate the state of WooCommerce orders by bypassing mandatory SMS verification controls. In e-commerce environments, such plugins are typically deployed as security layers to ensure that customers provide valid phone numbers for two-factor authentication or fraud prevention purposes before an order is finalized. The absence of proper authorization checks means that any user with network access can interact directly with the plugin's internal endpoints without possessing a valid session token or administrative privileges, fundamentally undermining the intended security posture of the application.
Technically, the vulnerability stems from the plugin’s failure to validate whether the request originates from an authenticated and authorized source before processing state changes. When a WooCommerce order is marked as SMS verified, the system should verify that the user initiating this action has previously completed the legitimate verification process or holds appropriate permissions. Instead, the affected versions accept requests that simply set the verification status to complete without confirming the identity of the requester or validating the integrity of the transaction context. This lack of server-side validation enables an attacker to send crafted HTTP requests that artificially flip the order status from pending or unverified to verified. The exploit does not require any prior authentication, making it particularly dangerous as it can be executed by anonymous users scanning for vulnerable endpoints on public-facing websites.
The operational impact of this vulnerability is severe, primarily affecting the integrity of fraud prevention mechanisms and potentially leading to financial loss through fraudulent transactions. By bypassing SMS verification, attackers can complete purchases without providing valid contact information or undergoing identity checks designed to prevent bot attacks, card testing, or account takeover attempts. This undermines the core purpose of integrating FraudLabs Pro into the checkout flow. Furthermore, if the plugin is used in conjunction with other security plugins that rely on verified user states for further access control, this bypass could potentially lead to broader system compromises. The ability to forge verification status also complicates audit trails and forensic analysis, as legitimate orders may be indistinguishable from maliciously forged ones based solely on their final state within the database.
Mitigation strategies must prioritize immediate patching of the affected plugin versions to 1.12.2 or later, where these authorization checks have been implemented by the vendor. In scenarios where updating is not immediately feasible, administrators should implement web application firewall rules that restrict access to the specific API endpoints associated with SMS verification status updates to authenticated users only. Additionally, enabling rate limiting on checkout-related actions can help mitigate automated exploitation attempts. It is also advisable to review WooCommerce logs for any anomalous patterns of order status changes occurring without corresponding user login events or IP address consistency checks. Long-term remediation should involve adopting a defense-in-depth approach where critical state transitions are validated not just by the application layer but also through robust session management and strict adherence to principle of least privilege across all plugin interactions with the WordPress core.