Skip to main content

Wordpress Plugin CVE-2026-15014

| EUVDEUVD-2026-49709 CRITICAL
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
2026-07-28 Wordfence GHSA-6h5p-ffrw-w4fc
WordPress Authentication Bypass Wordpress Plugin Sms Alert Sms Otp For Woocommerce Order Notifications Abandoned Cart Recovery Cozyvision1
9.8
CVSS 3.1 · Vendor: Wordfence
View

Vulnerability Assessment

Weakness
CWE
CWE-288
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 28, 2026

Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the processRegistration() function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's billing_phone to obtain an authentication cookie. No public exploit code was identified at the time of analysis.

Affected VersionsENISA

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery 0 ≤3.9.7

Affected Packages

euvd sms_alert_sms_otp_for_woocommerce_order_notifications_abandoned_cart_recovery no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Wordpress Plugin gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

The SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing_phone parameter. This is due to the processRegistration() function using a phone-unbound $_SESSION['sa_mobile_verified'] boolean flag as the sole gate before issuing an authentication cookie - the flag is set to true after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's billing_phone value to have wp_set_auth_cookie() called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.

Articles & Coverage 2

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026 News Critical RCE in WordPress - CVE-2026-15014 Jul 28, 2026

Threat Intelligence Overview

EPSS Score
0.5%
Top 63% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Wordpress Plugin

View all
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-5084 CRITICAL POC
9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
CVE-2024-44000 CRITICAL POC
9.8 Oct 20

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL POC
9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
CVE-2025-11749 CRITICAL POC
9.8 Nov 05

The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint

CVE-2025-27007 CRITICAL POC
9.8 May 01

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
CVE-2016-1209 CRITICAL POC
9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
CVE-2024-4443 CRITICAL POC
9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL POC
9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
CVE-2023-6875 CRITICAL POC
9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
CVE-2024-1512 CRITICAL POC
9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
CVE-2024-4295 CRITICAL POC
9.8 Jun 05

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

Same weakness CWE-288 – Authentication Bypass Using an Alternate Path or Channel

View all
CVE-2024-1709 CRITICAL POC
10.0
CVE-2020-10148 CRITICAL POC
9.8
CVE-2024-55591 CRITICAL POC
9.8
CVE-2025-2747 CRITICAL POC
9.8
CVE-2025-2746 CRITICAL POC
9.8
CVE-2025-4427 MEDIUM POC
5.3
CVE-2025-34026 CRITICAL POC
9.2
CVE-2026-23760 CRITICAL POC
9.3

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15014 ADVISORY https://vuldb.com/vuln/383804 REF https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/FormInterface.php#L56 REF https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L252 REF https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L602 REF https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L680 REF https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L691 REF https://plugins.trac.wordpress.org/changeset?reponame=&old=3623914%40sms-alert&new=3623914%40sms-alert REF https://www.wordfence.com/threat-intel/vulnerabilities/id/661d4ea9-572d-4544-b5cf-39fd69c104a6?source=cve

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy