Authentication Bypass in WordPress SMS Alert Plugin Leads to Account Takeover (CVE-2026-15014)

A critical authentication bypass vulnerability, identified as CVE-2026-15014, affects all versions up to and including 3.9.7 of the "SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery" plugin for WordPress. This flaw enables unauthenticated attackers to perform account takeover. The vulnerability stems from the processRegistration() function's improper handling of the $_SESSION['sa_mobile_verified'] boolean flag, which is set to true after any successful One-Time Password (OTP) validation but is not bound to a specific phone number. This allows an attacker to complete OTP verification using a phone number they control, then subsequently submit a crafted registration request using a victim's known or guessable billing_phone value. This manipulation bypasses proper authentication, leading to the issuance of an authentication cookie for the victim's account and granting the attacker full control, including administrative access.

Attack Chain

1. An unauthenticated attacker initiates the OTP verification process within the vulnerable WordPress plugin using a phone number under their control.
2. The attacker successfully completes the OTP verification using their own phone number.
3. The plugin's processRegistration() function sets the $_SESSION['sa_mobile_verified'] flag to true, indicating a successful OTP validation, but critically, this flag remains unbound to the specific phone number used for verification.
4. The attacker then constructs and sends a specially crafted HTTP POST request targeting the plugin's registration endpoint, which utilizes the processRegistration() function.
5. In this request, the attacker includes the billing_phone parameter, supplying the known or guessable phone number of a legitimate WordPress user account (the victim).
6. Due to the previously set, phone-unbound $_SESSION['sa_mobile_verified'] flag, the processRegistration() function proceeds as if the victim's phone number has been legitimately verified.
7. The function then calls wp_set_auth_cookie(), resolving the victim's account based on the provided billing_phone and issuing an authentication cookie for that account to the attacker.
8. The attacker uses the stolen authentication cookie to gain full access and control over the victim's WordPress account, potentially including administrator privileges.

Impact

Successful exploitation of CVE-2026-15014 results in complete account takeover for any WordPress user whose registered phone number is known or can be guessed by the attacker. This includes high-privilege accounts such as administrators, leading to severe consequences including website defacement, data theft, arbitrary code execution (via plugin/theme editing), or further compromise of the web server. The CVSS v3.1 Base Score of 9.8 reflects the critical nature of this vulnerability, indicating easy exploitability and high impact on confidentiality, integrity, and availability.

Recommendation

• Immediately update the "SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery" plugin to a version patched against CVE-2026-15014 to prevent authentication bypass.
• Deploy the Sigma rule "Detects CVE-2026-15014 Exploitation Attempt (WordPress SMS Alert Plugin)" to your SIEM to identify suspicious interactions with the vulnerable processRegistration() function.
• Regularly review web server access logs for repeated POST requests to wp-admin/admin-ajax.php involving plugin-specific actions and the billing_phone parameter, as identified in the detection rule.