CVE-2026-15014
The SMS Alert – SMS & OTP for WooCommerce plugin is vulnerable to an authentication bypass that lets attackers take over any WordPress account whose phone number is known. By completing an OTP verification on a phone they control and then submitting a registration with the victim’s phone number, an attacker can be logged in as that user. The flaw exists in all plugin versions up to 3.9.7.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin, versions 3.9.7 and earlier.
Real-world impact
An attacker can log in as any existing WordPress user, including administrators, by exploiting the unbound OTP verification flag. This allows full control over the site, including content, settings, and data.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited over the network with no authentication, no user interaction, and gives attackers complete confidentiality, integrity, and availability compromise of the WordPress site.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
How it’s attacked
References & advisories
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.…
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.…
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.…
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.…
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.…
- plugins.trac.wordpress.org/changeset
- wordfence.com/threat-intel/vulnerabilitie…