CVE-2026-15206
High
Description
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSMS Alert
PublishedAug 2, 2026
First seenAug 2, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- SMS Alert3.9.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SMS Alert | v < 3.9.8 | 3.9.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.