SSL Wireless SMS Notification for WordPress versions up to and including 3.8.1 contains an authentication bypass vulnerability. The flaw allows unauthenticated attackers who know a phone-linked user's number to take over that account by exploiting improper verification in the final login step. The vulnerability arises because the final_login_ajax_action handler authenticates users based solely on attacker-controlled data without verifying the SMS OTP or server-side state.