Authentication bypass via session flag in SMS Alert WordPress plugin (CVE-2026-15014)

The SMS Alert plugin for WordPress contains an authentication bypass vulnerability in the `processRegistration()` function. The function uses a session-level boolean flag (`$_SESSION['sa_mobile_verified']`) as the sole gate before issuing an authentication cookie, without binding the flag to the phone number that was verified. An unauthenticated attacker can complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to gain full authentication as any existing WordPress user whose phone number is known or guessable, including administrators. Affected versions: - <= 3.9.7 We recommend updating to: 3.9.8. CVSS 9.8 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/661d4ea9-572d-4544-b5cf-39fd69c104a6?source=cve Details: https://vuln.today/cve/CVE-2026-15014