What is CVE-2026-94257?

CVE-2026-94257 is a high-severity vulnerability in Sms Alert, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2026-10-10.

How severe is CVE-2026-94257?

High severity. CVSS v3 base score is 8.1 out of 10.

Privilege escalation in Sms Alert

CVE-2026-94257

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

Vulnerability class: Privilege Escalation

Published 2026-10-10 · last modified 2026-10-10.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Sms Alert

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-94257?: CVE-2026-94257 is a high-severity vulnerability in Sms Alert, classified under Improper Privilege Management. CVSS score: 8.1/10. Published 2026-10-10.
How severe is CVE-2026-94257?: High severity. CVSS v3 base score is 8.1 out of 10.