Sms Alert
Monthly
Authentication bypass in the SMS Alert WordPress plugin before 3.9.8 allows unauthenticated remote attackers to log in as any registered user - including site administrators - by exploiting broken OTP session binding. The plugin marks a session as 'mobile verified' after an attacker validates an OTP to their own phone, then naively trusts a separately supplied, attacker-controlled phone number to resolve and authenticate the target account. A public proof-of-concept is available via WPScan; while EPSS remains low at 0.15% (5th percentile), the combination of administrative account takeover potential and available exploit code makes this a high-priority patch for affected WordPress deployments.
Authentication bypass in the SMS Alert WordPress plugin before 3.9.8 allows unauthenticated remote attackers to log in as any registered user - including site administrators - by exploiting broken OTP session binding. The plugin marks a session as 'mobile verified' after an attacker validates an OTP to their own phone, then naively trusts a separately supplied, attacker-controlled phone number to resolve and authenticate the target account. A public proof-of-concept is available via WPScan; while EPSS remains low at 0.15% (5th percentile), the combination of administrative account takeover potential and available exploit code makes this a high-priority patch for affected WordPress deployments.