A critical authentication bypass flaw in the SMS Alert plugin for WordPress allows unauthenticated attackers to hijack user accounts, including administrator accounts.

The processRegistration() function uses a session flag that is not bound to a specific phone number. Unauthenticated attackers can verify a phone number they control and then substitute the billing_phone parameter to log in as a victim, including administrative users.

The CVSS score of 9.8 highlights the potential for total account takeover. By gaining access to administrative accounts, an attacker can fully compromise the WordPress installation, potentially leading to unauthorized data access, malware distribution, or total site defacement.

Immediate Action: Update the SMS Alert plugin to the latest available version immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review user registration logs for anomalies, such as multiple registrations originating from the same IP address or unexpected changes to account phone numbers.

Compensating Controls: Disable user registration on the WordPress site until the plugin is updated, or implement additional secondary authentication factors that are not reliant on the vulnerable plugin.

Public Exploit Available: No confirmed public exploit.

Due to the critical nature of account takeover vulnerabilities, this issue should be treated with the highest priority. Administrators must update the plugin immediately to protect user accounts and maintain the integrity of their WordPress installation.