CVE-2026-40790 MEDIUM

CVE-2026-40790: WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability

Vendor Veronalabs
Product WP SMS
Weakness CWE-288
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP SMS versions up to 7.2.1 contain an authentication bypass that allows low-privileged users to read sensitive data they should not access. The vulnerability requires a valid user account but no additional user interaction. An attacker with low-level site access can retrieve confidential information without authorization.

What an attacker can do

03Attacker Capabilities

Read sensitive data restricted to higher-privilege users.

Potential impact on your site

04Site Impact

Confidential site data may be exposed to users with basic access (subscribers, contributors).

Conditions required to exploit

05Prerequisites

Valid low-privilege user account on the site; network access.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-13539 FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login CVE-2026-27049 WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerability CVE-2026-25471 WordPress Admin Safety Guard plugin <= 1.2.6 - Broken Authentication vulnerability CVE-2025-10484 Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass CVE-2025-13980 CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118