CVE-2026-94257highCWE-269

CVE-2026-94257: falha de alta gravidade em SMS Alert

SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SMS Alert

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.1epss 0.2%
The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · SMS Alert
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — SMS Alert

No mesmo produto, das mais perigosas para as menos.

CVE-2026-15206HIGHSMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-MobileEPSS 0.4%CVE-2026-94256HIGHSMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTPEPSS 0.2%CVE-2026-94258LOWSMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User ActionsEPSS 0.2%