sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1 on WordPress Login final_login_ajax_action sslcare_login_phone/cap_data improper authentication

Summaryinfo

A vulnerability was found in sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1. It has been rated as critical. The impacted element is the function final_login_ajax_action of the component Login Handler. This manipulation of the argument sslcare_login_phone/cap_data causes improper authentication. This vulnerability is handled as CVE-2026-96228. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in sslplugins SSL Wireless SMS Notification Plugin up to 3.8.1. It has been declared as critical. Affected by this vulnerability is the function final_login_ajax_action of the component Login Handler. The manipulation of the argument sslcare_login_phone/cap_data with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-96228 since 09/22/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-112590). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• sslplugins

Name

• SSL Wireless SMS Notification Plugin

Version

• 3.8.0
• 3.8.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion