Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15206 Unauthenticated Account Takeover in SMS Alert WordPress Plugin Before 3.9.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15206
Post summary
The text announces CVE-2026-15206, describing an unauthenticated account takeover flaw in the SMS Alert WordPress Plugin before version 3.9.8, but does not provide a PoC, exploit, mitigation, or evidence of active exploitation.
🚨*CVE* CVE-2026-15206 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifi… https://www.cve.org/CVERecord?id=CVE-2026-15206 ----- Traducción: CVE-2026-15206 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-15206, outlining a session flag binding flaw in the SMS Alert WordPress plugin prior to version 3.9.8, and points to the CVE record for more details.
CVE-2026-15206 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifi… https://www.cve.org/CVERecord?id=CVE-2026-15206
Post summary
The SMS Alert WordPress plugin before 3.9.8 contains a flaw where the session flag for mobile verification is not tied to the verified phone number, allowing potential abuse.