CVE-2026-94257
Received Received - Intake

Unauthenticated Password Reset in SMS Alert WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: WPScan

Description
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-94257
EUVD
EUVD-2026-96133

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SMS Alert 3.9.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the SMS Alert WordPress plugin versions 3.9.6 to 4.0.0. It allows unauthenticated attackers to reset passwords for any account, including administrators, by exploiting a flaw in the OTP password reset process. The plugin fails to properly link the account to the verified phone number during reset, enabling attackers to set new passwords on arbitrary accounts.

Detection Guidance

Check if the SMS Alert WordPress plugin version is between 3.9.6 and 4.0.0. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version details. Verify if the OTP password reset feature is enabled in plugin settings.

Impact Analysis

If you use the affected plugin versions, an attacker could gain control of your WordPress site by resetting an administrator's password. This could lead to full site compromise, data theft, or malware injection. Exploitation requires the OTP reset feature to be enabled, which is not default.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A breach may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update the SMS Alert plugin to version 4.0.1 or later immediately. Disable the OTP password reset feature if not required. Monitor administrator accounts for unauthorized changes and review user access logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart