Description
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting the site owner's paid SMS credits and spamming arbitrary third parties.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FraudLabs Pro SMS Verification | ≤ 1.12.1 | — |
References
- https://wpscan.com/vulnerability/6717eedf-5cdc-4e8a-b14b-94f3968a8aa2/ exploit vdb-entry technical-description