Critical SMS Alert WordPress Plugin Flaw Enables Unauthenticated Account Takeover
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jul 28, 2026
A critical authentication bypass vulnerability, tracked as CVE-2026-15014, affects the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin in versions through 3.9.7. The flaw stems from the plugin trusting a session-level $_SESSION['sa_mobile_verified'] flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s billing_phone value and trigger wp_set_auth_cookie() for the victim account.
The bug carries a CVSS 9.8 severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version 3.9.8, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
