PT-2025-17719 · WordPress · Verification Sms With Targetsms Plugin

Cheng Liu

·

Published

2025-04-24

·

Updated

2025-05-27

·

CVE-2025-3776

CVSS v3.1

8.3

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Verification SMS with TargetSMS plugin for WordPress versions up to, and including, 1.5
Description The issue is related to limited Remote Code Execution in the Verification SMS with TargetSMS plugin for WordPress. This vulnerability is due to a lack of validation on the type of function that can be called via the targetvr ajax handler function. As a result, unauthenticated attackers can execute any callable function on the site, such as phpinfo().
Recommendations For versions up to, and including, 1.5, consider disabling the targetvr ajax handler function until a patch is available to prevent exploitation. Restrict access to the admin-ajax.php endpoint to minimize the risk of exploitation. Avoid using the vulnerable plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-3776

Affected Products

Verification Sms With Targetsms Plugin