CVE-2026-15014
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The SMS Alert plugin for WordPress up to version 3.9.7 is vulnerable to authentication bypass leading to account takeover. The processRegistration() function uses a session flag $_SESSION['sa_mobile_verified'] as the sole gate before issuing an authentication cookie, but the flag is not bound to a specific phone number. An attacker can verify their own number, then submit a registration request with the victim's number, resulting in authentication as any existing WordPress user, including administrators.
Risk Assessment
An attacker can take over any user account, including administrators, without knowing the password, leading to full control of the WordPress site.
Recommendation
Update the SMS Alert plugin to version 3.9.8 or later immediately.
Original NVD description (English source)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.