Authentication Bypass in SMS Alert Plugin for WordPress
CVE-2026-94256
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-94256?
The SMS Alert plugin for WordPress, specifically versions prior to 4.0.1, contains a flaw that fails to ensure the legitimacy of the account linked to a one-time verification code. This oversight allows attackers to gain unauthorized access by substituting their phone number for that of any user, including those with administrative privileges. By successfully completing the verification code challenge, malicious actors can sign in as any user, thus compromising the security of the affected WordPress sites.
Affected Version(s)
SMS Alert 4.0.0 < 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.