SMS Alert OTP sessions can authenticate attackers as Administrators
SMS Alert before 3.9.8 marks a session as mobile-verified after the attacker completes an OTP challenge for their own phone, but does not bind that flag to the verified number. The signup/login handler then accepts a fresh attacker-supplied phone number, selects the WordPress account associated with it and issues a session. An unauthenticated attacker who knows an Administrator's billing phone can therefore take over that account.
- Component
- SMS Alert
- Plugin slug
sms-alert- Affected
- < 3.9.8
- Safe version
3.9.8- Published
- Aug 02, 2026
This CVE was published Aug 02, 2026 and is one of 18 known issues for this plugin.
Update, patch or deactivate.
Update SMS Alert to 3.9.8 or later. Invalidate active sessions, reset privileged credentials, review OTP and mobile-login activity and investigate actions by accounts with WooCommerce billing phone numbers.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N