SMS Alert WordPress plugin: Authentication bypass via SMS login code
Summary
The SMS Alert WordPress plugin before version 4.0.1 does not verify that the logged-in account is the one the verified one-time code was issued for. An unauthenticated attacker can sign in as any user with a stored phone number, including administrators, by completing a code challenge on a phone they control. Successful exploitation gives full control over the affected WordPress site.
Affected
- SMS Alert WordPress plugin, all versions before 4.0.1 (CNA range; one aggregator lists 4.0.0 to below 4.0.1)
- Only relevant where SMS-based OTP login is enabled and users have stored phone numbers
Fixed in
- Version 4.0.1
- Vendor release status in the WordPress.org repository: Unknown.
Workaround
- Disable SMS-based authentication until the plugin is updated, if possible.
- Review user accounts with stored phone numbers, especially administrators, and remove stale numbers.
- Restrict admin login (wp-login.php) to trusted IP addresses or a VPN where feasible.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS is low (about 0.001 to 0.002, time-sensitive).
- No public proof-of-concept found; status treated as unknown.
Our recommendation
- Update the SMS Alert plugin to version 4.0.1 or later on all WordPress sites without delay. Also apply the same update for CVE-2026-94257 and CVE-2026-94258, which are fixed in the same release.
- Until patched, disable SMS-based login or restrict it to non-administrator accounts where possible.
- Check WordPress logs for administrator logins without a matching OTP event.
- Verify the installed version after the update and do not assume that the earlier fix in 3.9.8 (CVE-2026-15206) covers this issue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- OpenCVE CVE-2026-94256 app.opencve.io
- VulDB CVE-2026-94256 vuldb.com
- Vulners Rapid7 CVE-2026-94256 vulners.com
- SentinelOne CVE-2026-15206 www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:17.
Original description (NVD)
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.