High severity · published Oct 10, 2026
CVE-2026-94257
SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SMS Alert ·
3.9.6 before 4.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94257
exploit
https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/
More from SMS Alert
8.1
CVE-2026-94256
SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
7.5
CVE-2026-15206
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
2.7
CVE-2026-94258
SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions