sslplugins vulnerabilities and threats

SSL Wireless SMS Notification for WordPress versions up to and including 3.8.1 contains an authentication bypass vulnerability. The flaw allows unauthenticated attackers who know a phone-linked user's number to take over that account by exploiting improper verification in the login process. The vulnerability arises because the final login step matches user sessions based solely on attacker-controlled data without verifying the SMS OTP or server-side state.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.

Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.