CVE-2026-15206 describes an improper authentication vulnerability (CWE-287) in the SMS Alert WordPress plugin versions prior to 3.9.8. The plugin fails to bind the "mobile verified" session flag to the phone number that was actually verified via OTP. As a result, an attacker who successfully verifies an OTP sent to their own phone can then supply a different phone number during the signup or login process. The plugin uses this attacker-supplied phone number to select the user account and logs the attacker in as that user without further verification. This flaw allows unauthenticated attackers to log in as any user, including administrators who have a billing phone number on file.

An unauthenticated attacker can bypass authentication controls and log in as any user, including administrators, by exploiting the improper binding of the verified session flag to the phone number. This compromises the confidentiality of user accounts but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider disabling or restricting the SMS Alert plugin to mitigate risk.