Loading story…
A critical authentication bypass vulnerability, tracked as CVE-2026-15014, affects the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin in versions through 3.9.7. The flaw stems from the plugin trusting a session-level $_SESSION['sa_mobile_verified'] flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s billing_phone value and trigger wp_set_auth_cookie() for the victim account.
The bug carries a CVSS 9.8 severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version 3.9.8, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was fixed in SMS Alert version 3.9.8. The update binds OTP verification to the verified phone number and is the recommended remediation for affected sites.
Public proof-of-concept details became available for the SMS Alert authentication bypass, and exploitation attempts were reported. This raised the urgency for administrators to patch immediately or temporarily disable the plugin.
A critical authentication bypass vulnerability, tracked as CVE-2026-15014, was disclosed in the SMS Alert WordPress plugin. The flaw lets an unauthenticated attacker abuse OTP verification and the billing_phone parameter to obtain an authentication cookie for another user's account, including administrators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as **`CVE-2026-8457`**, affects the **WooCommerce - Social Login** WordPress plugin by WPWeb in all versions through **`2.8.7`**. The flaw allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by forging an Apple **`id_token`** JWT with a victim's email address. Researchers said the plugin's Apple login handler decodes the token payload but does not verify the JWT signature against Apple's public keys or validate core claims such as issuer, audience, and expiry. The attack is further enabled by a login-flow nonce that is exposed to unauthenticated users through a localized JavaScript object on the login page. The issue has a **CVSS 9.8** rating and is classified as **`CWE-289`**, reflecting the risk of full account takeover and complete site compromise when an administrator account is targeted. The vulnerability is fixed in **`2.8.8`**, and public reporting said no active exploitation had been confirmed at the time of disclosure.
Aug 2, 2026
A critical vulnerability in the *Post SMTP* WordPress plugin, tracked as CVE-2025-11833, has exposed over 400,000 WordPress sites to potential account and website takeover. The flaw, present in all plugin versions up to and including 3.6.0, stems from missing capability checks in the `__construct` function, allowing unauthenticated attackers to reset passwords for any user, including administrators. Wordfence, which received the initial bug report via its bounty program, has already blocked more than 4,500 attack attempts, and exploitation activity has accelerated since early November. Security researchers warn that at least 210,000 sites remain at risk, with attackers leveraging the vulnerability to access password reset messages and hijack admin accounts. Website owners are strongly advised to update to the patched version released on October 29 or disable the plugin to prevent compromise. The incident follows a previous security issue (CVE-2025-24000) affecting the same plugin, highlighting ongoing risks for sites relying on outdated or unpatched WordPress extensions.
Jun 29, 2026
A critical authentication bypass and privilege escalation flaw tracked as **`CVE-2026-61967`** affects the **miniOrange OTP Verification** WordPress plugin in versions **`<= 5.5.1`**, allowing unauthenticated attackers to take over accounts, including administrators. The bug occurs in password reset handling when the plugin is used with **Ultimate Member**: the vulnerable code accepts a publicly exposed WordPress nonce but fails to verify that OTP validation actually happened, enabling attackers to trigger password resets for arbitrary users and recover a valid reset URL and secret hash from the HTTP redirect response.
Aug 15, 2026