CVE-2026-94258
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The SMS Alert WordPress plugin before version 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the plugin's gateway credentials to be stored on the acting administrator's own site.
Risk Assessment
Disclosure of phone numbers of users from other sites in a multisite network can violate privacy and enable phishing or other abuses. The risk applies to WordPress multisite installations with this plugin.
Recommendation
Update the SMS Alert plugin to version 4.0.1 or later, which includes a fix for administrator permission checks.
Other vulnerabilities in SMS Alert WordPress plugin
See all- CVE-2026-94257Unknown
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number verified during its OTP password reset. This allows unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
- CVE-2026-94256Unknown
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to. This allows unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
- CVE-2026-15206High
The SMS Alert WordPress plugin before version 3.9.8 does not bind its 'mobile verified' session flag to the phone number that was actually verified. After an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Original NVD description (English source)
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS