CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
Unauthenticated attackers can bypass authentication and take over any WordPress user account, including administrators, by manipulating the billing phone parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15014?
CVE-2026-15014 is a critical authentication bypass vulnerability in cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
Weakness: CWE-288
Which versions are affected by CVE-2026-15014?
How do I fix CVE-2026-15014?
No fix has been published for CVE-2026-15014 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15014 being exploited?
There is no known exploitation of CVE-2026-15014 in the wild and no public exploit code.
Sources
Also known as GHSA-6h5p-ffrw-w4fc.