CVE-2026-94257
UnknownSummary
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
Risk Assessment
An unauthenticated attacker can take over any account, including administrator, by setting a new password. This leads to full compromise of the WordPress site.
Recommendation
Upgrade the SMS Alert plugin to version 4.0.1 or later. Until then, consider disabling the OTP password reset feature.
Other vulnerabilities in SMS Alert WordPress plugin
See all- CVE-2026-94256Unknown
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
- CVE-2026-94258Low
The SMS Alert WordPress plugin before version 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the plugin's gateway credentials to be stored on the acting administrator's own site.
- CVE-2026-15206High
The SMS Alert WordPress plugin before version 3.9.8 does not bind its 'mobile verified' session flag to the phone number that was actually verified. After an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Original NVD description (English source)
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS