CVE-2026-15206 is an improper authentication vulnerability (CWE-287) in the SMS Alert WordPress plugin prior to version 3.9.8. The vulnerability arises because the plugin fails to associate the "mobile verified" session flag with the actual phone number verified by the OTP process. Consequently, an attacker who successfully verifies an OTP sent to their own phone can manipulate the login process by providing a different phone number, causing the system to authenticate them as the user linked to that phone number. This allows unauthorized login as any user, including administrators, without prior authentication.

An unauthenticated attacker can gain unauthorized access to any user account, including administrator accounts, by exploiting the improper binding of the verified phone number in the SMS Alert plugin. This compromises account confidentiality and integrity, potentially allowing full control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of the SMS Alert plugin or disable the plugin to prevent exploitation.