# CVE-2026-96228 - SSL Wireless SMS Notification \<= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover

DevFeed: [CVE-2026-96228 - SSL Wireless SMS Notification \<= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover](<https://devfeed.tech/articles/cve-2026-96228-ssl-wireless-sms-notification-3-8-1-unauthenticated-authentication-bypass-to-account-takeover-105763.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-96228>)

Author: CVEFEED.io

Published: 2026-10-29T03:39:15Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [3](<https://devfeed.tech/tags/3.md>), [account](<https://devfeed.tech/tags/account.md>), [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [ajax](<https://devfeed.tech/tags/ajax.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-96228](<https://devfeed.tech/tags/cve-2026-96228.md>), [cvss](<https://devfeed.tech/tags/cvss.md>), [data](<https://devfeed.tech/tags/data.md>), [handler](<https://devfeed.tech/tags/handler.md>), [login](<https://devfeed.tech/tags/login.md>), [matching](<https://devfeed.tech/tags/matching.md>), [notification](<https://devfeed.tech/tags/notification.md>), [published](<https://devfeed.tech/tags/published.md>), [sms](<https://devfeed.tech/tags/sms.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [wireless](<https://devfeed.tech/tags/wireless.md>)

## AI overview

SSL Wireless SMS Notification versions up to and including 3.8.1 have an authentication bypass that can enable unauthenticated account takeover when an attacker knows a phone number linked to a user. The public OTP login flow stores an attacker-chosen cap_data value before sending an SMS; the final login handler matches the stored row using only the phone number and cap_data, without verifying the SMS OTP or server-side single-use state, then identifies the account through the sslcare_login_phone user meta. The source rates the issue 8.1 (High) and marks it remotely exploitable.

## Source excerpt

CVE ID :CVE-2026-96228 Published : Oct. 29, 2026, 3:39 a.m. | 38 minutes ago Description :SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...