The SMS Alert – SMS & OTP for WooCommerce plugin is vulnerable to an authentication bypass that permits an unauthenticated attacker to impersonate any WordPress user whose phone number is known. The flaw arises because the `processRegistration()` routine relies on a session flag that simply records that an OTP was verified, without tying that flag to the specific phone number. An attacker can first verify an OTP for a phone number they control, setting the session flag to true, then submit a registration request using a victim’s `billing_phone`. Because the flag is already true, the plugin calls `wp_set_auth_cookie()` for the resolved victim account, granting full authentication as that user, including administrators.

The vulnerability affects the Cozyvision1 SMS Alert – SMS & OTP for WooCommerce plugin, covering all releases up to and including version 3.9.7.

The CVSS score of 9.8 indicates critical severity, but the EPSS score of less than 1 % shows a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Attackers would need to control a phone number, run an OTP verification, and then submit a crafted registration request with a target’s phone number. No additional prerequisite such as code execution or administrative access is required, making the vector purely web‑based.