CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
Explanation of Vulnerability in Simple Terms
Service Finder SMS System versions 2.0.0 and earlier contain an authentication bypass vulnerability. An attacker can exploit this flaw to gain unauthorized access to the system without valid credentials. The vulnerability requires specific network conditions to exploit but can result in complete compromise of confidentiality, integrity, and availability.
What an attacker can do
Bypass authentication and gain unauthorized access to the Service Finder SMS System without valid credentials.
Potential impact on your site
Attackers can access, modify, or disable the SMS system and potentially access sensitive data stored within it.
Conditions required to exploit
Network access to the affected system; no user interaction or authentication required.
Key dates
External resources
Related vulnerabilities
