SMS Alert CVE-2026-94258

Exploitation requires a WordPress multisite network (the flaw affects multisite deployments only), and the attacker must already hold administrator privileges on at least one subsite (PR:H). A further concrete prerequisite from the description: the SMS Alert plugin's SMS gateway credentials must be configured and stored on the acting administrator's own site before the vulnerable billing-phone-number retrieval path can be reached. Limiting factors that reduce real-world risk: no unauthenticated access is possible, single-site (non-multisite) installations are not affected, and the attacker needs an existing trusted administrator role - so this is realistically an insider or compromised-admin cross-tenant disclosure rather than remote unauthenticated exploitation.

This is a low-severity, low-priority issue despite the network attack vector. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N = 2.7) tells a consistent story: exploitation requires an already-privileged actor (PR:H - a WordPress administrator), yields only limited confidentiality impact (C:L), and has no integrity or availability impact. The signals do not conflict, but several are simply absent: no EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is further constrained by the description's two hard preconditions - the deployment must be a WordPress multisite network, and the plugin's gateway credentials must be stored on the acting administrator's own site - which make this a narrow, insider-style privilege/authorization boundary flaw (CWE-200, broken access control on user management) rather than a broadly exploitable remote bug. One nuance worth flagging: NVD scored this S:U (scope unchanged), but the vulnerability lets an administrator of one site read data belonging to users of *other* sites in the network, which is a cross-authority disclosure and is arguably a scope change (S:C); this does not materially raise priority but is noted below in the independent assessment. Bottom line: a genuine but minor information-disclosure flaw, appropriately patched, not an emergency.

In a WordPress multisite network, a malicious or curious administrator of one subsite - who has legitimately configured the SMS Alert plugin's gateway credentials on their own site - invokes the plugin's billing-phone-number retrieval functionality. Because the plugin never verifies that the acting administrator is authorized to manage the selected users, it returns the stored billing phone numbers of users belonging to other sites on the network, leaking PII across the tenant boundary. No public exploit identified at time of analysis; exploitation requires existing administrator access and the multisite precondition.