SMS OTP Session Binding Bypass in WordPress Plugin

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SMS Alert WordPress plugin before version 3.9.8 contains a critical authentication flaw where the "mobile verified" session flag is not properly bound to the phone number that was actually verified. An attacker can verify an OTP sent to their own phone number, then supply a different victim's phone number during login to hijack that account. This affects any WordPress site using the vulnerable plugin with users who have billing phone numbers on file, including administrators. The vulnerability is particularly dangerous because it requires no prior access or credentials—an unauthenticated attacker can immediately gain full administrative control.

Casky's 283 matching skills, powered by Claude AI with extended reasoning, would identify this attack pattern across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners analyzing this CVE would see detection findings focused on: (1) session management anomalies where verified phone numbers don't match the account being accessed, (2) impossible travel or geographic inconsistencies in OTP verification versus login origin, (3) repeated failed OTP attempts from different phone numbers for the same account, and (4) privilege escalation patterns showing low-privilege or unauthenticated users gaining administrative access immediately after OTP verification. The skills would flag deviations from normal authentication flows, particularly the disconnect between phone verification events and subsequent account access, helping practitioners hunt for successful exploitation in their logs and implement compensating controls before patching.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15206.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-15206

Casky has 283 skills that investigate the attack patterns behind CVE-2026-15206. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn