CVE-2026-15014: WordPress SMS Alert Auth Bypass Vulnerability

CVE-2026-15014 Overview

CVE-2026-15014 is an authentication bypass vulnerability in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The flaw affects all versions up to and including 3.9.7. The processRegistration() function relies on a phone-unbound $_SESSION['sa_mobile_verified'] boolean flag as the sole authorization gate before issuing a WordPress authentication cookie. Unauthenticated attackers can verify an OTP for a phone number they control, then submit a registration request containing a victim's billing_phone value to have wp_set_auth_cookie() called for the resolved victim account. The weakness is cataloged as [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated attackers can take over any WordPress account, including administrator accounts, when the target's registered phone number is known or guessable.

Affected Products

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress
All plugin versions up to and including 3.9.7
WordPress sites running WooCommerce with the SMS Alert plugin enabled

Discovery Timeline

2026-07-28 - CVE-2026-15014 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15014

Vulnerability Analysis

The vulnerability resides in the WooCommerce registration handler shipped with the SMS Alert plugin. During the OTP workflow, a successful phone verification sets $_SESSION['sa_mobile_verified'] to true. This flag records that some phone number was verified but stores no reference to which number was validated. The processRegistration() function later reads this flag as the sole gate before authenticating the user identified by the submitted billing_phone value. Because the verified state is decoupled from the submitted identifier, the trust boundary between OTP proof and account resolution collapses.

Root Cause

The root cause is missing binding between the verified factor and the identity claim. Session state records only a boolean outcome, not the phone number that was verified. When registration processing resolves an existing WordPress account by the attacker-supplied billing_phone, no comparison is performed against the previously verified number. WordPress then issues an authentication cookie via wp_set_auth_cookie() for the resolved user, bypassing password authentication entirely.

Attack Vector

An unauthenticated attacker completes an OTP challenge for a phone number under their control to set the session flag. The attacker then submits a registration request replacing billing_phone with a victim's registered phone number, such as an administrator's. The plugin resolves the existing account tied to that number and issues a valid authentication cookie to the attacker. The attack is remote, requires no user interaction, and requires only that the victim's phone number is known or can be enumerated. Exploitation details and vulnerable code paths are documented in the Wordfence Vulnerability Analysis and the WordPress SMS Alert WooCommerce Registration Code.

Detection Methods for CVE-2026-15014

Indicators of Compromise

Successful WordPress logins for privileged users without a corresponding wp-login.php password submission event.
OTP verification requests followed by registration submissions containing a billing_phone value belonging to an existing account.
New authentication cookies issued to sessions that only interacted with SMS Alert OTP endpoints.
Administrative actions (plugin installs, user role changes) originating from IP addresses not previously associated with admin accounts.

Detection Strategies

Inspect WordPress access logs for POST requests to the SMS Alert OTP verification endpoint immediately followed by WooCommerce registration submissions from the same session.
Correlate wp_set_auth_cookie invocations with the phone number that was OTP-verified in the same session; a mismatch indicates exploitation.
Alert on privileged account logins that lack a preceding password authentication event in the audit trail.

Monitoring Recommendations

Enable verbose audit logging for authentication and user session creation events on WordPress and WooCommerce.
Monitor for enumeration behavior against phone-number-based account lookup endpoints.
Review administrator session activity daily for unexpected geolocations, user agents, or IP addresses.

How to Mitigate CVE-2026-15014

Immediate Actions Required

Update the SMS Alert plugin to a version later than 3.9.7 as soon as the vendor releases a fixed build.
Force logout of all active WordPress sessions and rotate authentication salts in wp-config.php.
Reset passwords for all administrator and privileged user accounts.
Audit the WordPress users table for unauthorized role changes or newly created accounts.

Patch Information

Review the WordPress SMS Alert Changeset for the code changes addressing the session binding issue. Administrators should upgrade to the patched release published on the WordPress plugin repository once available and verify the fix by confirming the OTP verification state is bound to the specific phone number.

Workarounds

Deactivate the SMS Alert plugin until a patched version can be installed if OTP-based registration is not business-critical.
Disable OTP-based registration and login flows in the plugin configuration, restricting authentication to password-based methods.
Deploy a Web Application Firewall (WAF) rule to block registration submissions where billing_phone matches an existing user account phone number.
Restrict access to WooCommerce registration and OTP endpoints by IP allowlist where feasible.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate sms-alert

# Rotate WordPress authentication salts to invalidate existing sessions
wp config shuffle-salts

# Audit administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered