The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to …

CVE-2026-15014 is a critical authentication bypass vulnerability in the SMS Alert WordPress plugin (versions up to and including 3.9.7). The flaw exists in the processRegistration() function, which relies on a session boolean flag $_SESSION['sa_mobile_verified'] that is set to true upon any successful OTP validation, without binding it to the specific phone number that was verified. An unauthenticated attacker can exploit this by completing OTP verification with a phone number they control, then resubmitting the registration request with a victim's billing_phone value. This causes wp_set_auth_cookie() to be called for the victim's account, granting full authentication. The vulnerability enables complete account takeover for any WordPress user whose phone number is known or guessable, including administrators. A patch was introduced in changeset 3623914 of the sms-alert plugin repository.