The SMS Alert WordPress plugin before version 4.0.1 does not verify that the one‑time code entered belongs to the user attempting to log in, allowing an attacker who can receive an OTP on a phone they control to sign in as any user with a stored phone number, including administrators. This flaw creates an authentication bypass that grants full access to the site’s administrative functions and sensitive data, thereby compromising confidentiality, integrity, and availability. Based on the description, it is inferred that an attacker can fully compromise the site by using the login flow without prior authentication.

Any WordPress site that uses the SMS Alert plugin older than 4.0.1 is affected. The vendor, SMS Alert, distributes the plugin as a WordPress add‑on, and sites that rely on OTP for user authentication expose their admin accounts whose phone numbers are known to attackers.

Attackers can trigger an OTP request for a target user’s phone number and complete the login challenge remotely; no prior authentication is required. The vulnerability is not listed in CISA KEV and the EPSS score is 0.00136, indicating a very low but non‑zero exploitation probability. However, the CVSS score of 8.1 indicates high severity. The likely attack vector is remote delivery of an OTP challenge to a phone controlled by the attacker. Once compromised, an attacker can access and modify any content, install malware, or delete the site.