A phone-unbound session flag in the SMS Alert plugin for WooCommerce lets unauthenticated attackers log in as any WordPress user, administrators included, whose registered phone number they know or can guess.
What Is It
CVE-2026-15014 is an authentication bypass leading to account takeover in the "SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery" plugin for WordPress, published 2026-07-28 by Wordfence. It is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and rated CVSS 3.1 base score 9.8 (CRITICAL): vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The flaw sits in processRegistration(), which uses the $_SESSION['sa_mobile_verified'] boolean as the sole gate before issuing an authentication cookie. That flag is set to true after any successful OTP validation and is never bound to the phone number that was actually verified.
Why It Matters
Exploitation requires no privileges, no user interaction, and no local access. An attacker completes OTP verification for a phone number they control, then resubmits the registration request with a victim's billing_phone value. The plugin resolves that number to the victim's account and calls wp_set_auth_cookie() for it; granting full authenticated access as that user. Against an administrator account, this is a complete site compromise, which the confidentiality/integrity/availability HIGH ratings reflect.
What's Vulnerable
- Vendor: cozyvision1
- Product: SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery (WordPress plugin)
- Affected versions: the vulnerable
processRegistration()code is directly verifiable in the 3.9.6 source tree, which is the newest release in which it has been confirmed present; the advisory reports the flaw as affecting releases through 3.9.7, so operators running any version at or below 3.9.7 should treat themselves as exposed - Attack parameter:
billing_phonein the WooCommerce registration flow
Patch Status
NVD status is "Received" as of 2026-07-28, meaning the record has not yet been enriched or analyzed by NVD. The Wordfence references include a plugin changeset (3623914@sms-alert) associated with the fix, so the corrected code is already committed to the plugin repository. Operators should update to the current release from the WordPress plugin repository, any build that post-dates 3.9.7 and includes changeset 3623914, and verify the deployed version against the Wordfence advisory. Given a network-reachable, unauthenticated path to administrator takeover, treat this as an immediate-priority update rather than a scheduled one; sites that cannot update promptly should restrict access to the WooCommerce registration endpoint in the interim.
Sources
- NVD, CVE-2026-15014: https://nvd.nist.gov/vuln/detail/CVE-2026-15014
- Wordfence Threat Intel advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/661d4ea9-572d-4544-b5cf-39fd69c104a6?source=cve
- WordPress Plugin Trac changeset (fix): https://plugins.trac.wordpress.org/changeset?reponame=&old=3623914%40sms-alert&new=3623914%40sms-alert
- Vulnerable code,
wc-registration.php: https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L252 - Vulnerable code,
FormInterface.php: https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/FormInterface.php#L56