Description (CNA)
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / SMS Alert | affected 0 before 3.9.8 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.