Exploit discussion active in current signal (6 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-11756 CVE-2026-16812 CVE-2026-48030 CVE-2026-15014 CVE-2026-51303 ..🧵👇
Post summary
The post lists five CVEs but provides no details on exploitation, mitigation, or technical nature.
[CVE] CVE-2026-15014 [HIGH PRIORITY] #SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeove... 🔗 https://exploitgrid.net/cve/CVE-2026-15014
Post summary
The text announces a high-priority vulnerability (CVE-2026-15014) that allows unauthenticated authentication bypass in SMS Alert <=3.9.7, potentially enabling account takeover.
🚨 CVE-2026-15014 — CVSS 9.8/10 ██████████ The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/saPd4qMv21
Post summary
The tweet announces a critical CVE (CVE‑2026‑15014) for a WooCommerce plugin and urges users to apply a patch, but offers no exploit details or technical breakdown.
CVE-2026-15014 (CVSS 9.8): Auth bypass risk in SMS Alert WooCommerce plugin up to certain versions. Update promptly if using WordPress. https://nvd.nist.gov/vuln/detail/CVE-2026-15014 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/6N2a9pKXTX
Post summary
The tweet announces a new high‑severity authentication bypass vulnerability (CVE‑2026‑15014) in the SMS Alert WooCommerce plugin and urges users to update as soon as possible.
🔐 CVE-2026-15014: Critical SMS Alert WordPress Plugin Authentication Bypass (CVSS 9.8) Critical authentication bypass in the SMS Alert WordPress plugin. 🔗 https://threataft.com/articles/sms-alert-wordpress-auth-bypass-account-takeover-cve-2026-15014?utm_source=twitter&utm_medium=social&utm_campaign=share #CyberSecurity #ThreatIntel https://t.co/8R5hey8NDD
Post summary
A critical CVE‑2026‑15014 authentication bypass in the SMS Alert WordPress plugin has been disclosed, with a CVSS score of 9.8; the post provides no patch, exploit tool, or evidence of active exploitation.
CVE-2026-15014 Authentication Bypass and Account Takeover in SMS Alert P... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15014 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-15014, noting it as an authentication bypass/account takeover in SMS alerts and provides a link to vulnerability details—no exploit or patch info is included.