SMS Alert vulnerabilities
We track 3 vulnerabilities in SMS Alert products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest SMS Alert vulnerabilities
- 8.1 High severity
SMS Alert: Improper Privilege Management
The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account
- 8.1 High severity
SMS Alert: Improper Authentication
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by
- 7.5 High severity
SMS Alert: Improper Authentication
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied ph