CVE-2026-40790 is an authentication bypass vulnerability (CWE-288) in VeronaLabs WP SMS versions up to 7.2.1. This flaw allows an attacker with some privileges to bypass authentication controls using an alternate path or channel, resulting in exposure of subscriber sensitive data. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating that it can be exploited remotely with low attack complexity and no user interaction, but requires privileges. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability can lead to unauthorized access to subscriber sensitive data due to authentication bypass. The confidentiality of subscriber data is impacted (high), but integrity and availability are not affected. This could result in privacy violations and potential misuse of subscriber information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, limit access privileges to trusted users and consider additional access controls to reduce risk.