CVE-2026-15014 describes an authentication bypass vulnerability (CWE-288) in the cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin. The vulnerability exists in the processRegistration() function, which relies on a session boolean flag ($_SESSION['sa_mobile_verified']) that is set to true after any successful OTP verification but is not bound to the verified phone number. An attacker can verify an OTP for a phone number they control, then resubmit a registration request with a victim's billing_phone parameter. This causes the plugin to call wp_set_auth_cookie() for the victim's account, effectively authenticating the attacker as that user, including administrators if their phone number is known or guessable. The vulnerability affects all versions up to and including 3.9.7. No official patch or remediation is currently documented.

Successful exploitation allows unauthenticated attackers to bypass authentication and fully impersonate any WordPress user whose phone number is known or guessable, including administrators. This leads to complete account takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor or plugin author and apply patches promptly once released. Avoid exposing or using phone numbers as authentication factors without proper binding and verification.