CVE-2026-94257: SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it if they can complete the OTP verification using a phone number they control. The flaw then allows the attacker to choose an arbitrary account whose password will be reset, including an administrator account.
Which plugin versions are affected?
SMS Alert versions before 4.0.1 are affected. The reported vulnerable range specifically includes 3.9.6 through 4.0.0.
What is the practical impact of successful exploitation?
An attacker can set a new password for an arbitrary WordPress account and then authenticate as that user. Resetting an administrator account password can result in administrative control of the WordPress site.