Skip to content
Threat Feed
Subscribe

Product

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Plugin (< 3.9.7)

1 brief RSS
critical advisory

Authentication Bypass in WordPress SMS Alert Plugin Leads to Account Takeover (CVE-2026-15014)

An authentication bypass vulnerability (CVE-2026-15014) in the 'SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery' WordPress plugin allows unauthenticated attackers to achieve account takeover by exploiting a flaw in the `processRegistration()` function's OTP verification, enabling authentication as any existing WordPress user with a known phone number.

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin +1 wordpress authentication-bypass account-takeover web-application cve
1r 2t 1c