What is the CVSS score of CVE-2026-15014?

CVE-2026-15014 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Sms Alert Sms Otp For Woocommerce Order Notifications Abandoned Cart Recovery CVE-2026-15014

EUVD-2026-49709 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-28 Wordfence

GHSA-6h5p-ffrw-w4fc

Authentication Bypass WordPress Sms Alert Sms Otp For Woocommerce Order Notifications Abandoned Cart Recovery

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 07:51 vuln.today

CVE Published

Jul 28, 2026 - 06:54 cve.org

CRITICAL 9.8

DescriptionCVE.org

The SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing_phone parameter. This is due to the processRegistration() function using a phone-unbound $_SESSION['sa_mobile_verified'] boolean flag as the sole gate before issuing an authentication cookie - the flag is set to true after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's billing_phone value to have wp_set_auth_cookie() called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.

Articles & Coverage 2

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026 News Critical RCE in WordPress - CVE-2026-15014 Jul 28, 2026

AnalysisAI

Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the processRegistration() function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's billing_phone to obtain an authentication cookie. …