{"affected":[{"defaultStatus":"unknown","ecosystem":"https://wordpress.org/plugins","product":"FraudLabs Pro SMS Verification","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.12.1","status":"affected","version":"1.11.2","versionType":"semver"}]}],"cveId":"CVE-2026-106008","cwes":["CWE-862"],"description":"The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0/"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: contact@wpscan.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794223038627,"publishedAt":1794219891108,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0/"},{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0/"}],"remediation":[],"revision":"49f2372543f40f7a7a1299006bca51513537130d1654216ecb40f59c96d9a498","sources":[{"modifiedAt":1794219891108,"name":"CNA: WPScan","retrievedAt":1794222499444,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106008"},{"modifiedAt":1794223038627,"name":"NVD","retrievedAt":1794226703531,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106008"}],"ssvc":null,"status":"published","title":"FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified","updatedAt":1794226703531}