CVE-2026-94257

Summary

The SMS Alert WordPress plugin has a privilege escalation vulnerability where attackers can reset passwords for any user account by verifying a one-time code sent to their own phone number, bypassing the requirement that the OTP be sent to the target account's verified phone number. This allows unauthenticated attackers to gain admin access to arbitrary accounts.

Exploitability

Exploitation requires an attacker to have access to a phone number that can receive SMS messages, but no authentication is needed to initiate the password reset process, making it moderately difficult to exploit with preconditions of having a valid target account and a phone number capable of receiving SMS.

Blast radius

If exploited, this vulnerability could allow attackers to compromise any WordPress user account including administrators, potentially leading to full site takeover and data breaches.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.0.1 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.