SMS Alert Plugin Account Takeover via OTP Verification Bypass

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SMS Alert WordPress plugin before version 4.0.1 contains a critical authentication bypass vulnerability that allows unauthenticated attackers to take over any account, including administrator accounts, without knowing the original password. The flaw exists in the OTP (one-time password) password reset mechanism, which fails to properly bind the verified phone number to the specific user account being modified. An attacker can initiate a password reset for any target account, receive an OTP on their own phone number, and use that code to set a new password on the victim's account. This is particularly dangerous because it bypasses WordPress's standard authentication controls and affects websites using this plugin for account security—potentially compromising thousands of sites that rely on SMS-based password recovery.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to identify the attack patterns underlying this vulnerability, particularly within MITRE ATT&CK's Initial Access technique (TA0004). Practitioners using Casky would detect reconnaissance probes targeting WordPress installations with the SMS Alert plugin, followed by exploitation attempts that submit OTP verification requests. The platform would flag suspicious patterns such as: OTP codes being verified against mismatched user accounts, password reset requests from unusual geographic locations, and successful authentication changes without corresponding email confirmations. Security teams would see findings highlighting the gap between phone verification and account binding, recommendations to upgrade to 4.0.1 or later, and detection rules to monitor for account takeover activities targeting administrative users. Extended reasoning analysis would correlate multiple failed reset attempts with eventual successful account modifications as indicators of active exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-94257.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-94257

Casky has 224 skills that investigate the attack patterns behind CVE-2026-94257. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn