# CVE-2026-94257: SMS Alert WordPress plugin unauthenticated account takeover via password reset

Source: https://junglewise.ai/threats/cve-2026-94257-the-sms-alert-wordpress-plugin-before-4-0-1-does-not-bind-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-94257 · Severity: high · CVSS 8.1 · Published 2026-10-10

The SMS Alert WordPress plugin contains a flaw in its optional OTP-based password reset feature that allows attackers to take over any account, including administrator accounts, without authentication. An attacker can intercept a password reset code sent to their own phone number and use it to reset the password of a different account by exploiting the lack of account binding validation. This enables complete compromise of WordPress sites where this feature is enabled.

Vendors: [WPScan](https://junglewise.ai/threats/vendors/wpscan).

## Quick answers

**Is CVE-2026-94257 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94257 being exploited in the wild.

**How severe is CVE-2026-94257?** High severity, with a CVSS score of 8.1, published 10 October 2026.

**Which products and versions are affected?** WPScan SMS Alert 3.9.6 to 4.0.0.

**Is there a fix for CVE-2026-94257?** Yes: fixed in 4.0.1. Until then: Disable the optional OTP password reset feature in the plugin settings until the update to version 4.0.1 can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94257 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94257?** Check whether you run WPScan SMS Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.1

Disable the optional OTP password reset feature in the plugin settings until the update to version 4.0.1 can be applied.

## Technical details

The plugin fails to properly bind the account being reset to the phone number that was actually verified during OTP password reset, allowing an unauthenticated attacker to bypass authentication and perform privilege escalation. The vulnerability is a broken authentication flaw (CWE-269) requiring only the optional OTP password reset feature to be enabled on the target site. An attacker gains the ability to set arbitrary passwords on any account, achieving full account takeover.

## Affected products

- WPScan SMS Alert 3.9.6 to 4.0.0

## Timeline

- 2026-10-08: disclosed
- 2026-10-10: advisory
- 2026-10-10: patched: Fixed in version 4.0.1

## References

- [https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/](https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/)