SMS Alert for WordPress: account takeover via password reset (CVE-2026-94257)
The SMS Alert WordPress plugin does not bind the account whose password is being changed to the phone number that was actually verified during OTP password reset. An unauthenticated attacker can set a new password on any account, including an administrator. CVSS score: 8.1.
Checked in Shield: no
Who is affected
WordPress sites running SMS Alert versions before 4.0.3 that use the one-time code password reset.
How to check
In the WordPress admin, open the Plugins page and find SMS Alert. If the installed version is below 4.0.3, the site is vulnerable.
How to fix
Update SMS Alert to version 4.0.3 or later, which fixes the issue. After updating, it is reasonable to review the list of administrator accounts for unexpected changes.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: the NVD entry for CVE-2026-94257.
