Description
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aonetheme | Service Finder SMS System | ≤ 2.0.0 | — |