CVE-2026-94258: SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only WordPress multisite networks are affected. The issue applies to SMS Alert versions before 4.0.1.
What access and conditions are required to exploit this?
An attacker needs administrator access to one site in the multisite network. SMS Alert gateway credentials must also be stored on that administrator's own site.
What information can be exposed?
A site administrator can retrieve stored billing phone numbers for users associated with other sites on the same multisite network. The provided information indicates disclosure only, with no integrity or availability impact.
What should be done to remediate the issue?
Update the SMS Alert WordPress plugin to version 4.0.1 or later. If updating cannot be performed immediately, limit administrator access on sites where the plugin gateway credentials are stored and review cross-site bulk user actions.