# CVE-2026-15206: SMS Alert WordPress plugin authentication bypass in OTP verification

Source: https://junglewise.ai/threats/cve-2026-15206-sms-alert-wordpress-plugin-authentication-bypass-in-otp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15206 · Severity: high · CVSS 7.5 · Published 2026-08-02

SMS Alert is a WordPress plugin that enables phone-based account signup and login using one-time passwords (OTP). The plugin fails to bind the verification flag to the specific phone number that was verified, allowing an attacker to verify an OTP sent to their own phone and then use that verified status to log into any user account whose phone number they know. This enables account takeover of any user, including administrators.

## Quick answers

**Is CVE-2026-15206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15206 being exploited in the wild.

**How severe is CVE-2026-15206?** High severity, with a CVSS score of 7.5, published 2 August 2026.

**Which products and versions are affected?** SMS Alert SMS Alert before 3.9.8.

**Is there a fix for CVE-2026-15206?** A patch was published on 2026-08-02: Version 3.9.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15206?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass caused by improper session state binding in the OTP verification flow. The plugin sets a "mobile verified" session flag during OTP validation but does not tie it to the specific phone number that was actually verified. An unauthenticated attacker can: (1) request an OTP for their own phone number, (2) validate the OTP they receive to set the session flag, and (3) re-use that flag to log in as any other user by supplying a different phone number in the login request. The attack requires WooCommerce to be active, the "Signup with Mobile" feature to be enabled, knowledge of a target user's phone number, and requires network access to the vulnerable endpoint. Patches are available in version 3.9.8 and later.

## Affected products

- SMS Alert SMS Alert before 3.9.8

## Timeline

- 2026-07-20: disclosed
- 2026-08-02: patched: Version 3.9.8 released

## References

- [https://wpscan.com/vulnerability/d0bb4c41-392a-4209-9e44-93dbf3898417/](https://wpscan.com/vulnerability/d0bb4c41-392a-4209-9e44-93dbf3898417/)