CVE-2026-95514: Netgsm Authentication Bypass Vulnerability

CVE-2026-95514 Overview

CVE-2026-95514 is an unauthenticated bypass vulnerability affecting the Netgsm WordPress plugin in versions up to and including 2.10.0. The flaw is categorized under [CWE-289] Authentication Bypass by Alternate Name/Path, indicating the plugin fails to properly validate identity or authentication assumptions before allowing certain actions. An unauthenticated remote attacker can reach the affected code path over the network without user interaction. Successful exploitation results in a limited integrity impact on the WordPress site.

Critical Impact
Unauthenticated attackers can bypass authentication controls in the Netgsm plugin to modify limited data on affected WordPress installations without user interaction.

Affected Products

Netgsm WordPress plugin, versions <= 2.10.0
WordPress sites with the Netgsm plugin installed and activated
Any hosting environment exposing the vulnerable plugin endpoint to the internet

Discovery Timeline

2026-09-23 - CVE-2026-95514 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95514

Vulnerability Analysis

The vulnerability resides in the Netgsm WordPress plugin, a component used to integrate the Netgsm SMS gateway with WordPress sites. Attackers reach the vulnerable functionality over the network without credentials or user interaction. The classification under [CWE-289] indicates the plugin trusts an alternate identifier or path as a substitute for authentication. This trust decision allows unauthenticated requests to invoke functionality that should be restricted to authenticated users.

The scope of impact is limited to integrity. Confidentiality and availability are unaffected according to the published vector. This pattern is consistent with plugin endpoints that accept requests without verifying nonces, capabilities, or session state before performing state-changing operations.

Root Cause

The root cause is improper authentication enforcement in one or more Netgsm plugin request handlers. Under [CWE-289], the plugin makes access decisions based on data that an attacker can supply or predict, rather than on a verified authentication token. Reference implementations of this weakness typically omit current_user_can() capability checks or wp_verify_nonce() validation on AJAX or REST endpoints exposed by the plugin.

Attack Vector

Exploitation requires only network access to the WordPress site running the vulnerable plugin. An attacker crafts an HTTP request to the affected plugin endpoint without providing valid authentication credentials. The plugin processes the request as if it originated from a permitted actor and performs the associated action. Because no user interaction is required, exploitation can be scripted and executed at scale against exposed WordPress installations.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2026-95514

Indicators of Compromise

Unauthenticated HTTP requests to Netgsm plugin endpoints under /wp-content/plugins/netgsm/ or plugin-registered admin-ajax.php and REST routes
WordPress options, postmeta, or plugin-specific database rows modified without a corresponding authenticated administrator session in access logs
Outbound SMS traffic or Netgsm API calls originating from the site outside expected business workflows

Detection Strategies

Inventory WordPress installations and flag any running the Netgsm plugin at version 2.10.0 or earlier
Review web server access logs for POST or GET requests to Netgsm plugin routes lacking authenticated session cookies
Correlate WordPress audit log entries for plugin configuration changes with the originating IP address and authentication state

Monitoring Recommendations

Enable a WordPress activity or audit logging plugin to record configuration changes and plugin API invocations
Forward web server and WordPress logs to a centralized analytics platform for anomaly detection on plugin endpoints
Alert on repeated requests from a single source targeting /wp-json/ or admin-ajax.php routes registered by the Netgsm plugin

How to Mitigate CVE-2026-95514

Immediate Actions Required

Update the Netgsm plugin to a version later than 2.10.0 once the vendor publishes a fix
Deactivate and remove the Netgsm plugin on sites where the integration is not actively used
Restrict access to the WordPress administrative interface and plugin endpoints using IP allowlisting where feasible
Rotate any Netgsm API credentials configured in WordPress if unauthorized modification is suspected

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the current patch status and vendor guidance. At the time of publication, the advisory identifies versions <= 2.10.0 as vulnerable.

Workarounds

Deploy a web application firewall rule blocking unauthenticated requests to Netgsm plugin endpoints
Temporarily disable the plugin until a patched version is installed
Enforce authentication on admin-ajax.php and REST API routes via server-level access controls where the plugin allows

bash

# Example: block unauthenticated access to the Netgsm plugin directory via nginx
location ~* /wp-content/plugins/netgsm/ {
    deny all;
    return 403;
}