The vulnerability exists in the SMS Alert WordPress plugin versions prior to 4.0.1. The plugin fails to bind the account whose password is being reset to the phone number that was verified during the OTP reset. Because the binding is missing, any user who can obtain a one‑time code for a phone number under their control can reset the password of any account, including administrators. This allows an unauthenticated attacker to change the password of any existing account, granting them full control of the WordPress site – a classic privilege escalation.

The affected product is the SMS Alert WordPress plugin called SMS Alert, which is used by WordPress sites. The flaw is present in all releases from 3.9.6 through 4.0.0. Versions 4.0.1 and later contain the remediation. No other products or vendors are listed.

The CVSS score is 8.1, indicating high severity, and the EPSS score is 0.00136, suggesting a very low exploitation probability. Because the flaw allows an attacker to obtain a one‑time code by sending messages to a phone number they control, the attack vector is likely web‑based and remote; the attacker needs only the ability to trigger an OTP and receive the code. Once the code is obtained, the attacker can reset any user’s password on the site. Given the high impact of site takeover and the low exploitation probability, the risk is considered high. The vulnerability is not listed in CISA’s KEV catalog.