8.1
High
CVE-2026-94257 SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Description
The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SMS Alert 3.9 | 3.9.6 → < 4.0.3 | 4.0.3 |
Other CVEs of SMS Alert
The 4 CVEs of SMS Alert →
CVE-2026-94256
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified…
8.1
High
CVE-2026-94258
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the…
2.7
Low
CVE-2026-15206
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that…
7.5
High