{"id":"CVE-2026-94256","title":"The SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, includi…","summary":"The SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, includi…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-287"],"published":"2026-10-10","updated":"2026-10-13","sourceUpdated":"2026-10-13T20:36:00.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94256","references":[{"url":"https://wpscan.com/vulnerability/38b4e7f9-d73e-4c4d-bb9c-4c2dd1f4d7d9/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.00226,"epssPercentile":0.13266,"ingestedAt":"2026-10-10T06:24:42.873Z","product":"SMS Alert","affected":["sms_alert >= 4.0.0 < 4.0.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-10T12:01:49.531832Z"},"slug":"CVE-2026-94256","body":"## Overview\n\nThe SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":218862,"id":"CVE-2026-94256","ts":1791635591439,"field":"cvss","old":null,"new":"8.1"},{"seq":218861,"id":"CVE-2026-94256","ts":1791635591439,"field":"severity","old":"none","new":"high"}]}