CVE-2026-94256: SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

Q: Which accounts can an attacker impersonate?

Any WordPress user account with a stored phone number can be targeted, including administrator accounts.

Q: What does an attacker need to exploit this issue?

The attacker must be able to complete the one-time-code challenge using a phone number they control. They do not need prior authentication to the WordPress site.

Q: Which plugin versions are affected?

Versions before 4.0.1 are affected. Updating to version 4.0.1 or later addresses the described issue.

Published Oct 10, 2026

Updated

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

Affected Software

1 affected component

SMS Alert SMS Alert WordPress plugin<4.0.1

Event History

Oct 10, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which accounts can an attacker impersonate?

Any WordPress user account with a stored phone number can be targeted, including administrator accounts.

What does an attacker need to exploit this issue?

The attacker must be able to complete the one-time-code challenge using a phone number they control. They do not need prior authentication to the WordPress site.

Which plugin versions are affected?

Versions before 4.0.1 are affected. Updating to version 4.0.1 or later addresses the described issue.