{"affected":[{"defaultStatus":"unknown","ecosystem":"https://wordpress.org/plugins","product":"FraudLabs Pro SMS Verification","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.12.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106007","cwes":["CWE-770"],"description":"The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/6717eedf-5cdc-4e8a-b14b-94f3968a8aa2/"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794298959197,"publishedAt":1794298959197,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/6717eedf-5cdc-4e8a-b14b-94f3968a8aa2/"}],"remediation":[],"revision":"131ae81300405f0bcf0a13396a8eba25d7f0b416025770b8a1a1409ea5c88e47","sources":[{"modifiedAt":1794298959197,"name":"CNA: WPScan","retrievedAt":1794301700225,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106007"}],"ssvc":null,"status":"published","title":"FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send","updatedAt":1794301700225}