The FraudLabs Pro SMS Verification plugin (versions 1.11.2‑1.12.1) fails to enforce authorization or validity checks before marking a WooCommerce order’s SMS verification as complete. Consequently, an unauthenticated user can craft a request to the wc_sms_action_verified endpoint and falsely set an order to the verified state, bypassing the plugin’s verification controls. This flaw aligns with CWE‑284 (Improper Authorization), CWE‑285 (Improper Authentication), and CWE‑862 (Privilege Escalation), enabling attackers to trigger automatic order processing or other downstream actions that rely on verification status, potentially leading to financial loss or fraud.

Affected product is the FraudLabs Pro SMS Verification WordPress plugin for WooCommerce. Versions 1.11.2 to 1.12.1 are susceptible. Any WooCommerce site using one of these plugin releases is impacted.

The CVSS score of 5.3 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in CISA KEV. The flaw can be exploited by an unauthenticated attacker who sends a crafted request to the wc_sms_action_verified endpoint, bypassing authentication and verification checks. As a result, the attacker can forge verification states without needing to compromise user credentials or the server beyond HTTP request manipulation.