Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker can verify an OTP for their own phone number, substitute another user’s billing phone number, and receive that user’s WordPress login. If the victim is an administrator, the attacker could take full control of the site without knowing a password.
Executive priority
Treat as an immediate remediation priority on any affected site, especially ecommerce sites or installations where administrators have registered phone numbers. The flaw can bypass passwords and OTP intent entirely, enabling site takeover. Preserve relevant logs before session invalidation and conduct incident review where exposure existed.
Technical view
In SMS Alert versions through 3.9.7, processRegistration() treats the session-wide sa_mobile_verified boolean as sufficient authorization. Because that flag is not bound to the verified phone number, a later registration request can supply a victim’s billing_phone. The plugin resolves that account and calls wp_set_auth_cookie(), creating an authentication-bypass condition classified as CWE-288.
Likely exposure
WordPress sites running SMS Alert through version 3.9.7 may be exposed where the affected WooCommerce registration workflow is reachable. Risk is greatest when existing users’ registered phone numbers are public, leaked, reused, or guessable. The supplied affected-product metadata is inconsistent, listing version “0,” so confirm installed versions directly.
Exploitation context
The issue is remotely reachable, requires no prior account or victim interaction, and can compromise administrators when their phone number is known. The CVSS 3.1 score is 9.8. The source bundle reports that it is not in CISA KEV and provides no evidence of active exploitation.
Researcher notes
The central trust failure is authorization state scoped only to the session, rather than the verified phone identity. Assessment should trace OTP validation, session mutation, billing_phone account resolution, and authentication-cookie issuance. A WordPress changeset is referenced, but the supplied evidence does not explicitly establish a fixed version or confirm exploitation in the wild.
Mitigation direction
- Identify every site running SMS Alert and record its installed version.
- Check current vendor guidance and apply an officially released version that resolves CVE-2026-15014.
- Disable the affected registration functionality or plugin until remediation if no confirmed fixed release is available.
- Invalidate active WordPress sessions after remediation, prioritizing administrator accounts.
- Reset credentials and investigate further if suspicious account access is identified.
Validation and detection
- Confirm the installed plugin version is outside the documented affected range using authoritative vendor guidance.
- Verify WooCommerce registration and SMS Alert functionality are not exposed while awaiting remediation.
- Review OTP, registration, and authentication records for unusual sequences involving different phone numbers.
- Review administrator accounts for unexpected sessions, profile changes, new users, plugins, or configuration changes.
- Confirm session invalidation succeeded and privileged users must authenticate again.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-15014 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9WordfenceVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Vendor Notified
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/661d4ea9-572d-4544-b5cf-39fd69c104a6?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/woocommerce/wc-registration.php#L691CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.6/handler/forms/FormInterface.php#L56CVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3623914%40sms-alert&new=3623914%40sms-alertCVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.