CVE-2026-15206
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The SMS Alert WordPress plugin before version 3.9.8 does not bind its 'mobile verified' session flag to the phone number that was actually verified. After an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Risk Assessment
The organization risks complete account takeover of administrators and other users, potentially leading to full site compromise.
Recommendation
Immediately update the SMS Alert plugin to version 3.9.8 or later.
Other vulnerabilities in SMS Alert WordPress plugin
See all- CVE-2026-94257High
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
- CVE-2026-94256High
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
- CVE-2026-94258Low
The SMS Alert WordPress plugin before version 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the plugin's gateway credentials to be stored on the acting administrator's own site.
Original NVD description (English source)
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS