Read the docs
TI-2026-12637 Aliases CVE-2026-15014GHSA-6h5p-ffrw-w4fc

SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter

Priority MEDIUM 51CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00887 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cozyvision1SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recoveryup to 3.9.7—No fix listedCNA
  • SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Vendorcozyvision1 Affected up to 3.9.7 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:*:*:*:*——cozyvision1
  • cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:*:*:*:* Versions — — ·cozyvision1

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15014
  2. 2026-10-03 Alias added: GHSA-6h5p-ffrw-w4fc

References

Other 7

  • TI-2026-09827 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset CVSS 3.1CRITICAL 9.8
  • TI-2024-12594 SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2025-31830 WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-30179 WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-19859 WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2024-10871 Missing authorization in cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order… CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences