CVE-2026-94256

Summary

The SMS Alert WordPress plugin fails to verify that the logged-in account matches the verified one-time code, allowing attackers to impersonate any user with a stored phone number. This creates a high-impact authentication bypass vulnerability.

Exploitability

Exploitation requires an attacker to have access to a phone number already registered in the system, but is relatively straightforward once they control that phone number, requiring no authentication or privileged access.

Blast radius

An attacker could gain administrative access to WordPress sites using this plugin, potentially leading to full site compromise, data exfiltration, or hosting infrastructure takeover.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.0.1 or later to remediate this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.