The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The SMS Alert – SMS & OTP for WooCommerce plugin contains a critical authentication bypass vulnerability (CVE-2026-15014, CVSS 9.8) affecting all versions through 3.9.7. The vulnerability exists in the `processRegistration()` function, which relies on a single `$_SESSION['sa_mobile_verified']` boolean flag to gate authentication cookie issuance. Because this flag is phone-unbound and set to `true` after any successful OTP validation—regardless of which phone number initiated the request—attackers can manipulate the `billing_phone` parameter to hijack accounts without possessing the legitimate user's credentials or OTP. This affects any WordPress site running the vulnerable plugin with WooCommerce enabled, potentially exposing customer accounts, order data, and payment information to account takeover attacks.
Detecting this vulnerability pattern requires analysis of authentication logic flaws and session management weaknesses. Casky's Claude AI with extended reasoning would identify this as an Authentication Bypass attack by mapping the insecure session handling to techniques like T1110 (Brute Force) and T1021 (Remote Services) in the context of account compromise. Practitioners using Casky would observe findings highlighting: (1) insufficient authentication validation where session state is decoupled from user identity verification, (2) parameter tampering opportunities on phone-related inputs, (3) missing cryptographic binding between OTP tokens and specific user identities, and (4) session fixation risks where a verified state applies universally rather than to specific accounts. Extended reasoning analysis would emphasize that the vulnerability persists across versions 3.9.7 and earlier, suggesting comprehensive plugin updates are required alongside input validation hardening.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-15014. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation