Atomic Edge analysis of CVE-2025-5955 (metadata-based):
The Service Finder SMS System plugin for WordPress (slug: aone-sms) in versions up to and including 2.0.0 contains an authentication bypass vulnerability. An unauthenticated attacker can log in as any arbitrary user without verifying possession of that user’s phone number. This vulnerability carries a CVSS score of 8.1 with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high complexity but severe impact on confidentiality, integrity, and availability without requiring privileges or user interaction.
Root Cause: Based on the CWE-288 classification (Authentication Bypass Using an Alternate Path or Channel) and the vulnerability description, the plugin’s login flow likely uses a phone number as an identity claim but fails to verify that the attacker actually controls the phone number. Atomic Edge analysis infers that the plugin may implement a “login with SMS” or two-factor authentication feature where a user provides a phone number and the plugin attempts to verify via SMS code. The vulnerability arises when the plugin accepts any arbitrary phone number (or bypasses the OTP challenge entirely) and proceeds to log the user in. Without source code access, this conclusion is inferred rather than confirmed, but the CWE and description strongly point to a missing verification step in the SMS-based authentication flow.
Exploitation: An attacker can exploit this vulnerability by crafting a request to the plugin’s AJAX login endpoint (likely /wp-admin/admin-ajax.php with an action parameter such as aone_sms_login or aone_sms_verify_otp). The attacker provides a phone number that belongs to an existing WordPress user (or perhaps the plugin creates an account based on the phone number). Since the plugin does not verify that the attacker received the SMS, the attacker simply submits the request with the target phone number and possibly a known or empty OTP code. The plugin processes the login and returns a valid session cookie. The attack is unauthenticated and requires no prior access. Atomic Edge research cannot confirm the exact action or parameter names without source code, but typical patterns for SMS login in WordPress plugins involve POST requests to admin-ajax.php with parameters like action=login_with_sms, phone=target_phone, and code=any_value.
Remediation: The plugin must implement server-side verification of the phone number before completing the login. This typically involves generating a one-time password (OTP), sending it via SMS to the provided phone number, and requiring the user to submit the correct OTP before the login is processed. The OTP should be stored server-side with an expiration time and must be matched against the user’s submission. Additionally, the plugin should enforce that the OTP verification endpoint only accepts valid, unexpired codes. Without these checks, the authentication bypass persists. Since no patched version is available from the vendor, users must disable or remove the plugin immediately.
Impact: Successful exploitation allows an attacker to gain full access to any WordPress account that has a phone number associated with it via the plugin. Depending on the user’s role, this could lead to privilege escalation (e.g., becoming an administrator), data exposure, content manipulation, or complete site compromise. The attacker could then install malicious plugins, modify pages, exfiltrate user data, or use the WordPress admin panel to execute arbitrary code. The CVSS impact score of 8.1 (High/High/High) reflects the severe consequences of such a bypass.
