CVE-2026-11387: SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

Synopsis

An authentication bypass leading to privilege escalation affects the SMS Alert plugin for WordPress (versions up to and including 3.9.5). A remote attacker with no credentials can reset any account's password, including administrator accounts, by exploiting missing identity validation in the OTP-based password reset flow. Successful exploitation gives the attacker full control over the targeted WordPress account, enabling complete site takeover. No upstream fix has been published; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the flaw is exercisable by a completely unauthenticated attacker.

• Victim interactionNot required

  The attacker does not need the target user to click anything or take any action; the password reset request is issued entirely by the attacker.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: no race conditions or special memory layout are required, though the site must have OTP verification for password resets enabled and the target account must have a phone number configured.

Blast Radius

• Attacker resets an administrator's password and gains full WordPress admin access, including the ability to install arbitrary plugins or themes.
• Attacker reads, modifies, or deletes any content, user data, or WooCommerce order records stored in the database via the admin panel.
• Attacker exfiltrates stored customer PII and payment-related order details accessible through the WooCommerce back-end.
• Attacker deploys malicious code (via plugin or theme upload) to the WordPress instance, enabling persistent server-side execution.