What is the CVSS score of CVE-2026-15206?

CVE-2026-15206 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of SMS Alert are affected by CVE-2026-15206?

SMS Alert WordPress plugin versions prior to 3.9.8 contain a vulnerability allowing unauthorized attackers to gain administrative access to websites without credentials.. A patch is available.

Is there a public PoC exploit available for CVE-2026-15206?

Yes, a public proof-of-concept exploit is available for CVE-2026-15206. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15206?

Within 24 hours, audit all WordPress installations for SMS Alert plugin deployment and document current versions. Within 7 days, upgrade SMS Alert to version 3.9.8 or later on all affected sites and reset passwords for all administrator accounts as a precautionary measure. Within 30 days, review site access logs for suspicious administrative login activity and consider implementing additional security controls such as multi-factor authentication or enhanced audit logging for admin accounts.

SMS Alert CVE-2026-15206

EUVD-2026-51933 HIGH

Improper Authentication (CWE-287)

2026-08-02 WPScan

GHSA-63jw-46hv-gwp2

WordPress Authentication Bypass Sms Alert Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.4 CRITICAL

Network OTP flow requires no auth; admin session takeover enables full confidentiality and integrity impact, with low availability impact from potential content disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:23 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

7.5 (HIGH)

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.

AnalysisAI

Authentication bypass in the SMS Alert WordPress plugin before 3.9.8 allows unauthenticated remote attackers to log in as any registered user - including site administrators - by exploiting broken OTP session binding. The plugin marks a session as 'mobile verified' after an attacker validates an OTP to their own phone, then naively trusts a separately supplied, attacker-controlled phone number to resolve and authenticate the target account. A public proof-of-concept is available via WPScan; while EPSS remains low at 0.15% (5th percentile), the combination of administrative account takeover potential and available exploit code makes this a high-priority patch for affected WordPress deployments.

Technical ContextAI

SMS Alert (CPE: cpe:2.3:a:unknown:sms_alert:*:*:*:*:*:*:*:*) is a WordPress plugin providing OTP-based SMS authentication and notification workflows. The root cause is CWE-287 (Improper Authentication) - a session state confusion flaw where the 'mobile verified' flag is set without being cryptographically bound to the specific phone number that completed the OTP challenge. The plugin's signup/login handler decouples authentication proof (OTP completion) from identity resolution (phone-to-account lookup), trusting a fresh, attacker-supplied phone number parameter in the subsequent request rather than the verified number from the OTP flow. This is mechanically similar to a parameter tampering or forced-browsing class of attack applied to an OTP handshake, where the two steps of the protocol - verification and account selection - are not atomically linked.

RemediationAI

Update the SMS Alert WordPress plugin to version 3.9.8 or later immediately; the vendor has confirmed a patch is available, documented at https://wpscan.com/vulnerability/d0bb4c41-392a-4209-9e44-93dbf3898417/. If an immediate upgrade is operationally blocked, disable the OTP-based login and signup functionality provided by the plugin entirely - note this will break SMS authentication workflows for all users until patched. As a secondary compensating control, restrict access to the WordPress login and registration endpoints via IP allowlisting or a WAF rule targeting the specific OTP/phone-number parameters in the signup handler; this trades user accessibility for reduced attack surface. Following any patching, audit administrator session logs and user account creation timestamps for anomalous activity, as the public PoC availability means exploitation may have preceded detection. An exact patched release version beyond '3.9.8' is not independently confirmed beyond vendor advisory language.