CVE-2026-40790: WP SMS Information Disclosure Flaw

CVE-2026-40790 Overview

CVE-2026-40790 is a sensitive data exposure vulnerability in the WP SMS plugin for WordPress, affecting versions up to and including 7.2.1. The flaw is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel), allowing authenticated users with low privileges, such as subscribers, to access information they should not be able to view. An attacker holding a valid subscriber-level account can issue requests over the network and retrieve confidential data managed by the plugin.

Critical Impact
Authenticated subscribers can bypass intended access controls and read sensitive plugin data without administrator privileges.

Affected Products

WP SMS plugin for WordPress, versions <= 7.2.1
WordPress sites with WP SMS installed and active subscriber registration enabled
Environments where untrusted users hold subscriber-level accounts

Discovery Timeline

2026-06-15 - CVE-2026-40790 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40790

Vulnerability Analysis

The WP SMS plugin exposes functionality that returns subscriber-related data without enforcing sufficient authorization checks on the requesting user. The vulnerability falls under [CWE-288], indicating that the plugin permits access through an alternate path that does not apply the same authentication or role validation enforced elsewhere in the application.

An authenticated WordPress user with the subscriber role can invoke the affected endpoint and receive data intended only for administrators or privileged plugin operators. Because subscriber accounts are routinely granted to anonymous visitors on sites with open registration, the practical barrier to exploitation is low.

The confidentiality impact is high, while integrity and availability are not affected. The disclosed information may include subscriber records, phone numbers, or messaging metadata managed by the plugin. EPSS data lists a probability of 0.326% at the 24.198 percentile, reflecting limited active interest at the time of publication.

Root Cause

The root cause is missing or insufficient capability checks on a request handler within WP SMS. The plugin authenticates the session but fails to verify that the calling user holds the privilege required to view the requested resource. This is a classic authorization gap layered on top of a successful authentication step.

Attack Vector

The attack vector is network-based and requires low privileges, with no user interaction. An attacker authenticates as a subscriber, then sends a crafted HTTP request to the vulnerable WP SMS endpoint. The plugin responds with sensitive data instead of rejecting the request. No verified public exploit code is available; consult the Patchstack WP-SMS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-40790

Indicators of Compromise

Unexpected HTTP requests from subscriber-level accounts to WP SMS plugin endpoints under /wp-admin/admin-ajax.php or REST routes registered by the plugin
Outbound responses from WordPress containing subscriber phone numbers or SMS metadata to non-administrator sessions
Anomalous access patterns from newly registered subscriber accounts shortly after account creation

Detection Strategies

Review WordPress access logs for requests to WP SMS plugin actions originating from users without administrator capabilities
Inspect web application firewall logs for repeated requests to WP SMS AJAX or REST endpoints with low-privilege session cookies
Correlate new subscriber account registrations with immediate access attempts to plugin-managed resources

Monitoring Recommendations

Enable verbose logging on the WP SMS plugin and forward logs to a centralized analytics platform for retention and querying
Alert on response sizes from plugin endpoints that exceed expected baselines for non-administrative roles
Track the version of WP SMS deployed across all WordPress instances to identify hosts still running <= 7.2.1

How to Mitigate CVE-2026-40790

Immediate Actions Required

Update WP SMS to a version newer than 7.2.1 that contains the vendor fix referenced in the Patchstack advisory
Audit existing subscriber accounts and remove any that are unused or unrecognized
Review WP SMS data stores for evidence of unauthorized access by low-privilege accounts

Patch Information

Apply the patched release of WP SMS as indicated in the Patchstack advisory. Verify the installed version via the WordPress plugin dashboard or by inspecting the plugin header in wp-sms.php after the upgrade.

Workarounds

Disable open user registration on the WordPress site to prevent untrusted users from obtaining subscriber accounts
Deactivate the WP SMS plugin until the patched version can be installed if subscriber registration cannot be restricted
Restrict access to WP SMS AJAX and REST endpoints at the web server or WAF layer to authenticated administrators only

bash

# Configuration example: block low-privilege access to WP SMS endpoints via Nginx
location ~* /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^wp_sms_") {
        # Require administrator session cookie; otherwise return 403
        if ($http_cookie !~* "wordpress_logged_in_.*admin") {
            return 403;
        }
    }
}