CVE-2026-15014

Name of the Vulnerable Software and Affected Versions SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.8

Description An authentication bypass exists that allows for account takeover via the billing phone parameter. The issue occurs because the processRegistration() function relies on a $ SESSION['sa mobile verified'] boolean flag to issue an authentication cookie. Since this flag is not bound to a specific phone number, an unauthenticated attacker can verify a phone number they control to set the flag to true, and then resubmit the registration request using a victim's billing phone. This triggers the wp set auth cookie() function for the victim's account, granting the attacker full access to any WordPress user account with a known or guessable phone number, including administrator accounts.

Recommendations Update the plugin to a version newer than 3.9.7.