CVE-2025-3776 affects the Verification SMS with TargetSMS plugin for WordPress, allowing unauthenticated remote attackers to execute arbitrary callable functions through the 'targetvr_ajax_handler' function due to insufficient validation of callable function types. This improper control of code generation (CWE-94) can lead to limited remote code execution, potentially exposing site information or impacting site integrity. The vulnerability affects all versions up to and including 1.5. The CVSS 3.1 base score is 8.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker can remotely execute arbitrary callable functions on the affected WordPress site without authentication, which may lead to information disclosure (e.g., via phpinfo()), integrity compromise, and availability disruption. The impact is considered high due to the ability to execute code remotely and the lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin's AJAX handler if possible, or disable the plugin to prevent exploitation. Monitor official sources for updates and apply patches promptly once released.