{"id":"CVE-2026-94256","published":"2026-10-10T06:16:44.590","lastModified":"2026-10-13T20:36:00.850","description":"The SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/38b4e7f9-d73e-4c4d-bb9c-4c2dd1f4d7d9/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SMS Alert WordPress plugin fails to verify that the logged-in account matches the verified one-time code, allowing attackers to impersonate any user with a stored phone number. This creates a high-impact authentication bypass vulnerability.","exploitability":"Exploitation requires an attacker to have access to a phone number already registered in the system, but is relatively straightforward once they control that phone number, requiring no authentication or privileged access.","blast_radius":"An attacker could gain administrative access to WordPress sites using this plugin, potentially leading to full site compromise, data exfiltration, or hosting infrastructure takeover.","remediation":"Upgrade to version 4.0.1 or later to remediate this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","sms","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:57:35.814Z"}}