CVE-2026-54803

Name of the Vulnerable Software and Affected Versions SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.5

Description An issue exists where missing validation occurs between the phone number provided during login and the phone number verified via One-Time Password (OTP) in the session. This flaw allows session token reuse across different accounts, enabling authenticated attackers with subscriber-level access or higher to log in as any user, including administrators, without knowing the password. This is achieved by providing an arbitrary username after completing the OTP verification for a different phone number.

Recommendations Update to a version newer than 3.9.4.