SMS Alert CVE-2026-94256

Exploitation requires that SMS Alert's SMS/one-time-code login feature is active and that the target account - e.g., an administrator - has a phone number stored in its profile. The attacker initiates the code-login flow against that account and completes the OTP challenge using a phone they control; because the plugin never binds the verified one-time code to the account actually being logged into, any account with a stored number can be hijacked. Limiting factors that reduce real-world exposure: only users with stored phone numbers are vulnerable, the SMS login path must be enabled (not guaranteed on every install), and the attacker must know/target a specific such account - these constraints are what justify the AC:H rating despite unauthenticated network reach.

This is a genuine high-priority issue for any site running the affected plugin with SMS-based login enabled. The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H/I:H/A:H, score 8.1) describes a remote, unauthenticated, no-user-interaction authentication bypass that yields full administrator takeover - the maximum impact. The one mitigating signal in the vector is AC:H, reflecting that the attacker must target a specific account that has a phone number stored and that the OTP login path be usable, rather than a trivially universal exploit. No EPSS score, KEV entry, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or automated mass exploitation. The flaw was reported by WPScan, a credible source, and a vendor patch (4.0.1) exists. Net: treat as a serious, patch-now authentication bypass where the feature is in use, but note the real-world risk is bounded by AC:H and the absence of any exploitation-probability signal - prioritize sites that actually enable SMS/OTP login over those that merely have the plugin installed.

An attacker targets a WordPress site using SMS Alert's one-time-code login, selects an administrator account known to have a phone number on file, and initiates the login-by-code flow. Because the plugin never verifies that the validated OTP belongs to the account being signed into, the attacker completes the code challenge on their own phone and is authenticated as the administrator. No public exploit code was identified at time of analysis, but the logic flaw is straightforward to weaponize.