The SMS Alert WordPress plugin fails to tie the "mobile verified" flag to the specific phone number actually verified. As a result, an attacker who successfully verifies the one‑time password (OTP) sent to their own phone can supply any phone number during signup or login. The plugin then looks up the account associated with the supplied number and logs the user in, granting full access to that account, including administrative privileges if a billing phone is registered. This flaw allows an unauthenticated attacker to hijack any user account, achieving a complete breach of confidentiality, integrity, and availability for that account. The weakness maps to authentication bypass through a faulty credential handling process.

The vulnerability affects the SMS Alert plugin for WordPress versions older than 3.9.8. Any WordPress site that has the plugin installed and permits OTP‑based signup or login is susceptible. The flaw is limited to environments where user accounts have a billing phone stored and the plugin is actively used for account creation or recovery.

The CVSS score of 7.5 indicates a high severity for unauthenticated account takeover, while the EPSS score of <1% suggests a low overall probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely without prior authentication by sending an OTP to their own number and then providing a target phone number. The absence of binding between the OTP verification flag and the specific phone number makes the exploit trivially simple for anyone who can trigger the OTP workflow.