EUVD-2026-40922
GHSA-ggpj-jphc-wmc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with OTP password reset enabled
-
DeliverySend crafted unauthenticated reset request
-
ExploitChange admin account email address
-
ExecutionTrigger password reset to attacker email
-
ImpactSet new password and log in as admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the site to have the plugin's OTP verification for password resets feature explicitly enabled, and the targeted account (e.g. an administrator) must have a phone number configured for OTP verification - both are stated non-default prerequisites, without which the vulnerable path does not exist. Given those conditions, no authentication is required (PR:N) and the attack is remote over the network with no user interaction. The primary limiting factors are therefore the non-default OTP-password-reset configuration and the requirement that the victim account has an OTP phone number set; sites that do not use OTP-based password resets are not exploitable. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) presents this as trivially exploitable and unauthenticated, and the impact - full administrator takeover - is genuinely severe. However, the description imposes two real preconditions that raise practical complexity: the site must have OTP verification for password resets enabled, and the target user must have a phone number set for OTP. These are non-default conditions, so a more honest attack-complexity rating is arguably AC:H rather than AC:L, which would lower the real-world score below 9.8. There is no CISA KEV listing and no POC referenced, so exploitation is not confirmed active or public; EPSS and SSVC data were not provided. Net assessment: a high-priority patch for any store that has enabled OTP-based password resets, but the population of vulnerable sites is narrower than the raw 9.8 suggests because default installs without OTP password reset are not affected. |
| Exploit ScenarioDerived | An attacker who knows or guesses an administrator's WordPress username sends a crafted unauthenticated request to the plugin's OTP password-reset handler, changing the administrator's account email to one the attacker controls. The attacker then initiates a standard password reset, receives the reset link at the attacker-controlled email, sets a new password, and logs in with full administrator privileges. No public POC is referenced, but the network attack vector and low privilege requirement make weaponization straightforward once the vulnerable code path is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Account-takeover privilege escalation in the SMS Alert - SMS & OTP for WooCommerce WordPress plugin (versions up to and including 3.9.5) lets unauthenticated remote attackers change any user's email address and trigger a password reset, seizing administrator accounts. The flaw stems from the OTP-based password-reset flow failing to verify the requester's identity before updating account details. No public exploit has been identified at time of analysis, though the issue was disclosed by Wordfence and carries a 9.8 CVSS rating.
RemediationAI
Upgrade the SMS Alert plugin to the first release published after 3.9.5 (the WordPress.org changeset 3587983 for the sms-alert repository contains the fix; a released patched version number is not independently confirmed from the provided data, so verify the latest available version on the plugin page before deploying). Until you can update, disable OTP verification for password resets in the plugin settings - this removes the vulnerable code path entirely at the cost of losing SMS-based password-reset convenience - and/or have administrators remove their OTP phone numbers so their accounts cannot be targeted through this flow. As a compensating control, restrict access to WordPress login and password-reset endpoints (for example via Wordfence WAF rules or IP allow-listing of wp-admin) and enforce two-factor authentication independent of this plugin. Review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c31906da-f2fd-40ac-86e0-3f1ed0409d0c?source=cve for detection guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is a WordPress plugin (cpe:2.3:a:cozyvision1:sms_alert...) that adds SMS and OTP messaging to WooCommerce stores for order notifications, one-time passwords, and abandoned-cart recovery. The root cause is CWE-287 (Improper Authentication): the plugin's OTP password-reset handlers (referenced in class-wpresetpassword.php lines 68/116/130 and smsalert_form_handler.php line 91) accept requests to update a targeted user's profile - specifically the email address used for password recovery - without first proving the requester actually owns or controls that account or its associated phone number. Because WordPress password recovery keys off the account email, control of the email field is equivalent to control of the account.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated (AV:N/PR:N/UI:N) but AC:H because exploitation depends on the non-default OTP-password-reset config and the target having an OTP phone set; full account takeover yields C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.
Articles & Coverage 2
Executive ViewAI
A critical vulnerability in SMS Alert - SMS & OTP for WooCommerce (versions ≤3.9.5) enables unauthenticated attackers to seize administrative accounts by bypassing email verification in the password-reset workflow. WordPress merchants using this plugin face immediate risk of complete account compromise, including access to customer data, payment systems, and order management.
Disable the vulnerable plugin immediately. If continued operation is necessary, implement WAF rules blocking the password-reset endpoint, enable real-time alerts on account email modifications, enforce IP whitelisting for all administrator access, and configure continuous monitoring for suspicious authentication activity. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB