CVE-2026-11387: WordPress SMS Alert, unauthenticated password reset
When OTP verification is enabled for password resets, the change-password handler sets a new password without checking that the caller finished OTP. The target needs a phone number on file. An administrator reset is a full site compromise.
- Name
- CVE-2026-11387: WordPress SMS Alert, unauthenticated password reset
- Type
- N-day analysis
- CVE
- CVE-2026-11387
- CVE Risk
- critical
- Disclosure Status
- public
- Vendor
- Cozy Vision Technologies
- Affected
- WordPress plugin SMS Alert (sms-alert) through 3.9.5. Patched in 3.9.6.
- Published
- 28 Oct 2026
- Updated
- 28 Oct 2026
- Tags
- n-day, wordpress, cwe-287, auth
WordPress SMS Alert, unauthenticated password reset
I am @abraxas_null. The proof of concept is on GitHub: abraxas/CVE-2026-11387-WooCommerce-SMS-OTP (loopback client). Authorized lab only. The client talks to a WordPress host you pass on the command line. There is no lab/ tree in the repository.
SMS Alert hooks the WooCommerce / WordPress lost-password flow so that a one-time code sent by SMS is supposed to gate the new password. In affected versions the handler behind option=smsalert-change-password-form applies smsalert_user_newpwd without checking that the caller completed OTP verification or otherwise owns the account.
The official CVE record also notes that the same missing identity check can be used to change a victim's email address and then take over the account through a normal reset. Either path is unauthenticated account takeover.
Sites are only exposed when both of these are true:
- OTP verification for password resets is enabled in the plugin.
- The target user has a phone number stored for OTP (often
billing_phone).
Under those conditions the impact is full compromise of the chosen account. An administrator takeover is a full site compromise.
CVE-2026-11387 (NVD). CWE-287. Vendor: Cozy Vision Technologies. WordPress plugin SMS Alert (sms-alert) through 3.9.5. Patched in 3.9.6.
What an attacker can do
When OTP verification is enabled for password resets, the change-password handler sets a new password without checking that the caller finished OTP. The target needs a phone number on file. An administrator reset is a full site compromise.
The lab
The proof of concept is the Python client in the repository. Point it at a WordPress lab you control, with SMS Alert 3.9.5, OTP-on-reset enabled, and a user that has a phone number stored. It does not ship a webshell.