Description
The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | FraudLabs Pro SMS Verification | 1.11.2 – ≤ 1.12.1 | — |
References
- https://wpscan.com/vulnerability/e4ad41a9-86e9-4145-a417-0ccc7f76d2b0/ exploit vdb-entry technical-description