Loading vulnerability…
Authentication Bypass in SMS Alert WordPress Plugin via billing_phone
CVE-2026-15014 is a critical authentication bypass vulnerability in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The flaw affects all versions up to and including 3.9.7. The vulnerable logic is in the plugin's processRegistration() workflow, which relies on the session-level boolean flag $_SESSION['sa_mobile_verified'] as the sole condition before issuing a WordPress authentication cookie. Because this verification state is not bound to the specific phone number that successfully completed OTP validation, an unauthenticated attacker can first validate an OTP for a phone number they control, thereby setting the session flag to true, and then resubmit the registration flow with a victim user's billing_phone value. If that phone number resolves to an existing WordPress account, the plugin can invoke wp_set_auth_cookie() for that victim account. This results in authentication as arbitrary existing users whose registered phone numbers are known or guessable, including administrators.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows full account takeover of arbitrary existing WordPress users associated with known or guessable phone numbers. Compromise of an administrator account can lead to complete site takeover, including unauthorized administrative access, content and configuration changes, installation of malicious plugins or backdoors, creation of rogue accounts, data exposure, and broader integrity and availability impacts on the WordPress instance.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the SMS Alert plugin or at minimum disable the vulnerable registration and OTP workflow exposed through WooCommerce until the fixed version is deployed. Restrict public access to the affected registration endpoints where feasible using application-layer controls, rate limiting, or WAF rules. Monitor for anomalous OTP activity, repeated registration attempts within a single session using differing phone values, and suspicious logins to privileged accounts. Audit administrator accounts and invalidate suspicious sessions as a precaution.
Patch, then assume compromise.
Update the SMS Alert plugin to version 3.9.8 or later, which addresses the vulnerable authentication logic. The registration and OTP verification flow should ensure that OTP validation is cryptographically or logically bound to the exact phone number and account context being authenticated, rather than relying on a session-wide boolean flag. After patching, review authentication logs, active sessions, and privileged accounts for signs of prior compromise, especially unexpected administrator logins or account changes.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.