{"id":"CVE-2026-94257","published":"2026-10-10T06:16:44.717","lastModified":"2026-10-13T20:36:00.850","description":"The SMS Alert  WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SMS Alert WordPress plugin has a privilege escalation vulnerability where attackers can reset passwords for any user account by verifying a one-time code sent to their own phone number, bypassing the requirement that the OTP be sent to the target account's verified phone number. This allows unauthenticated attackers to gain admin access to arbitrary accounts.","exploitability":"Exploitation requires an attacker to have access to a phone number that can receive SMS messages, but no authentication is needed to initiate the password reset process, making it moderately difficult to exploit with preconditions of having a valid target account and a phone number capable of receiving SMS.","blast_radius":"If exploited, this vulnerability could allow attackers to compromise any WordPress user account including administrators, potentially leading to full site takeover and data breaches.","remediation":"Upgrade to version 4.0.1 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wp-plugin","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:57:27.869Z"}}