SMS OTP Validation Bypass in WordPress Authentication Plugin

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SMS Alert WordPress plugin before version 4.0.1 contains a critical authentication bypass vulnerability (CWE-287) that fails to validate the relationship between a one-time password (OTP) and the user account it was issued to. An unauthenticated attacker can intercept or obtain an SMS code sent to any registered user's phone number, then use that code to authenticate as that user without knowing their password. This is particularly dangerous because attackers can gain administrative access if they target administrator accounts, potentially leading to complete site compromise. Any WordPress installation using this plugin version is vulnerable if it has users with stored phone numbers, making this a widespread risk across the WordPress ecosystem.

Casky's 283 mapped security skills leverage Claude's extended reasoning to detect attack patterns associated with MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious authentication sequences: multiple failed OTP attempts followed by successful login from different IP addresses, SMS code usage without corresponding password verification events, or administrative accounts accessed via SMS authentication alone. The platform's skills would flag the absence of account-to-OTP binding validation in plugin code reviews and highlight authentication logs showing OTP completion occurring on devices that never received the original SMS push. These detection patterns help practitioners spot exploitation attempts before attackers establish persistence or exfiltrate sensitive data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94256.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-94256

Casky has 283 skills that investigate the attack patterns behind CVE-2026-94256. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn