Vulnerabilities / SMS Alert / WPSEC-2026-0414
SMS Alert <= 4.0.0 - Unauthenticated OTP Verification Bypass via Form Submission
Medium 5.3
CWE-602Fixed in 4.0.1
- ID
- WPSEC-2026-0414
- Plugin
- SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery (sms-alert)
- Affected
- all versions before 4.0.1
- Remediation
- Update to 4.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-602
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- SMS Alert on WPSec AttackSurface
- Fix released
- Published
Description
The SMS Alert plugin for WordPress is vulnerable to OTP Verification Bypass in its Contact Form 7, Elementor Forms and WPForms integrations in all versions up to, and including, 4.0.0. This is due to the server-side validation only enforcing OTP verification when the client-supplied 'option' parameter was present, rather than checking that the phone number had actually been verified. This makes it possible for unauthenticated attackers to submit OTP-protected forms with unverified phone numbers by omitting that parameter.
References
- https://wpsec.com/vuln/WPSEC-2026-0414/
- https://plugins.svn.wordpress.org/sms-alert/tags/4.0.1/
- https://wordpress.org/plugins/sms-alert/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS