SMS Alert: Privilege escalation via unbound OTP password reset
Summary
The SMS Alert plugin for WordPress and WooCommerce, versions 3.9.6 up to before 4.0.1, does not bind the account whose password is changed to the phone number verified during its OTP password reset. An unauthenticated attacker can verify a one-time code sent to a phone number they control and set a new password for any account, including administrators. This can lead to full administrative control of the WordPress site.
Affected
- SMS Alert WordPress plugin 3.9.6 up to before 4.0.1
- Default configuration: not affected
Fixed in
- Fixed in 4.0.1 (minimum fixed version)
- 4.0.2 is the current release
Workaround
Unknown.
Exploitation
- No public proof of concept or exploitation reports known at the time of research.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Update the SMS Alert plugin to 4.0.1 or later, preferably 4.0.2.
- Check whether the OTP password reset feature is enabled and disable it if it is not needed.
- Review user accounts for unexpected administrators and recent password changes.
- Monitor logs for password reset requests from unknown sources.
- Change administrator passwords after patching if compromise is suspected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: SMS Alert - Unauthenticated Privilege Escalation via Arbitrary Password Reset wpscan.com
- VulDB: CVE-2026-94257 vuldb.com
- OpenCVE: CVE-2026-94257 app.opencve.io
- VulDB: Entry 416111 vuldb.com
- WordPress.org: SMS Alert plugin wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:18.
Original description (NVD)
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.