{"id":"CVE-2026-94256","revision":"cd2e6cf7b6fa416b85954a2570416d17","records":[{"revision":"cd2e6cf7b6fa416b85954a2570416d17","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-94256","aliases":[],"title":"SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP","description":"The SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.","state":0,"publishedAt":"2026-10-10T06:00:10.076+00:00","modifiedAt":"2026-10-10T12:06:40.953+00:00","affected":[{"ecosystem":"Vendor product","name":"SMS Alert","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"SMS Alert\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.0.1\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/38b4e7f9-d73e-4c4d-bb9c-4c2dd1f4d7d9/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94256","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-94256","identifiers":["CVE-2026-94256"]},"retained":false,"historicalAffected":[]}],"coverage":[]}