Executive brief
SMS Alert is a WordPress plugin that enables phone-based account signup and login using one-time passwords (OTP). The plugin fails to bind the verification flag to the specific phone number that was verified, allowing an attacker to verify an OTP sent to their own phone and then use that verified status to log into any user account whose phone number they know. This enables account takeover of any user, including administrators.
Technical details
The vulnerability is an authentication bypass caused by improper session state binding in the OTP verification flow. The plugin sets a "mobile verified" session flag during OTP validation but does not tie it to the specific phone number that was actually verified. An unauthenticated attacker can: (1) request an OTP for their own phone number, (2) validate the OTP they receive to set the session flag, and (3) re-use that flag to log in as any other user by supplying a different phone number in the login request. The attack requires WooCommerce to be active, the "Signup with Mobile" feature to be enabled, knowledge of a target user's phone number, and requires network access to the vulnerable endpoint. Patches are available in version 3.9.8 and later.
Affected products
- SMS Alert SMS Alert before 3.9.8
Timeline
- 2026-07-20: disclosed
- 2026-08-02: patched: Version 3.9.8 released