The Verification SMS with TargetSMS plugin for WordPress contains a failure to properly validate the type of function that can be invoked through the 'targetvr_ajax_handler' endpoint. As a result, unauthenticated attackers can supply an arbitrary callable and cause the server to execute any PHP function, including sensitive functions such as phpinfo(). This vulnerability permits the attacker to run code directly on the site, potentially exposing server details, reading files, or escalating privileges if additional weaknesses exist.

All instances of the Verification SMS with TargetSMS plugin released by cajka, with affected versions up to and including 1.5. No later versions are mentioned in the data, so the risk applies to every release until 1.5.

The CVSS score of 8.3 indicates a high severity, and the EPSS score of less than 1% suggests a very low exploitation probability at the time of analysis, although the feature is exploitable by any visitor. The vulnerability is not listed in the CISA KEV catalog. Considering the description, the likely attack vector is a remote HTTP request to the AJAX handler with parameters crafted to call a malicious function; this does not require authentication.