Service Finder SMS System WordPress Plugin Authentication Bypass Vulnerability
Vulnerability
A vulnerability allowing authentication bypass has been identified in the Service Finder SMS System plugin for WordPress, affecting all versions through 2.0.0. The issue arises because the plugin fails to verify a user's phone number before logging them in, enabling unauthenticated attackers to log in as any user.
Impact
Exploitation of this vulnerability allows unauthenticated users to log in as arbitrary users, potentially leading to unauthorized access and actions within the affected WordPress site.
Remediation
No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.