Vulnerabilities / SMS Alert / WPSEC-2026-0413
SMS Alert <= 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
High 8.1
CWE-287Fixed in 4.0.1
- ID
- WPSEC-2026-0413
- Plugin
- SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery (sms-alert)
- Affected
- from 4.0.0 before 4.0.1
- Remediation
- Update to 4.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- SMS Alert on WPSec AttackSurface
- Fix released
- Published
Description
The SMS Alert plugin for WordPress is vulnerable to Authentication Bypass via its Login with OTP and WooCommerce Signup with Mobile features in version 4.0.0. This is due to the plugin storing the account selected when an OTP is requested and later logging in that account after a successful OTP check, without verifying that the phone number confirmed by the OTP belongs to that account. This makes it possible for unauthenticated attackers who know a user's registered phone number to log in as that user, including administrators, when these features are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0413/
- https://plugins.svn.wordpress.org/sms-alert/tags/4.0.1/
- https://wordpress.org/plugins/sms-alert/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS