blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-94258

LOW 2.7 CVSS 3.1
Published
October 8, 2026
Last modified
October 8, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-200
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.

Affected WordPress components

  • SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Plugin · sms-alert
    Confirmed match Active
    From 3.6.4 (including) to 4.0.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown SMS Alert — From 3.6.4 (including) to 4.0.1 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/25af3225-3b4b-4882-9af8-ab24597f9be2/
  • nvd.nist.gov Official NVD record