CVE-2026-11387

SMS Alert ≤ 3.9.5 — unauthenticated privilege escalation via arbitrary password reset

A critical improper-authentication flaw in the WordPress plugin SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. When OTP verification is enabled for password resets, an unauthenticated caller can set a new password for a user who has a phone number on file — including administrators — without proving possession of that phone.

This repository holds an Abraxas Labs proof-of-concept for authorized testing only — vendor disclosure, lab reproduction, or a host you have written permission to assess.

Summary

SMS Alert hooks the WooCommerce / WordPress lost-password flow so that a one-time code sent by SMS is supposed to gate the new password. In affected versions the handler behind option=smsalert-change-password-form applies smsalert_user_newpwd without checking that the caller completed OTP verification or otherwise owns the account.

The official CVE record also notes that the same missing identity check can be used to change a victim’s email address and then take over the account through a normal reset. Either path is unauthenticated account takeover.

Sites are only exposed when both of these are true:

1. OTP verification for password resets is enabled in the plugin.
2. The target user has a phone number stored for OTP (often billing_phone).

Under those conditions the impact is full compromise of the chosen account. An administrator takeover is a full site compromise.

Impact

Confidentiality, integrity, and availability are all high: the attacker can read orders and PII, change site content and users, and lock the legitimate owner out.

Technical notes

Password reset with SMS Alert roughly looks like this:

lost-password request  →  OTP to the user’s phone  →  verified change-password POST

The broken step is the last one. The plugin routes on $_REQUEST['option'] == 'smsalert-change-password-form' (see class-wpresetpassword.php in 3.9.5) and then writes the submitted password. It does not bind that POST to a prior OTP session, nonce, or capability check that would prove the caller is the user named in the reset.

This proof-of-concept stays on that handler:

1. Lost-password trigger — POST to WooCommerce /my-account/lost-password/ and /wp-login.php?action=lostpassword with wc_reset_password set, so the plugin’s reset path is entered for the victim username.
2. Unauthenticated password set — POST option=smsalert-change-password-form plus smsalert_user_newpwd / smsalert_user_cnfpwd to /, /my-account/lost-password/, and the wp-login lost-password action. A Location header containing password-reset=true is treated as success.
3. Login check — if the redirect did not confirm the reset, the script tries wp-login.php with the new password so a lab run can tell a true takeover from a miss (OTP option off, or no phone on the user).

No OTP is submitted. That is the bug.

Proof of concept

CVE-2026-11387-WooCommerce-SMS-OTP-Abraxas-Labs.py is a small Python 3 client: color banner, then the three steps above. It talks only to the URL you pass on the command line.

Requirements

• Python 3.9+
• requests

On macOS with Homebrew Python (PEP 668), use a venv rather than a system pip install:

python3 -m venv .venv
.venv/bin/pip install requests

Usage

CVE-2026-11387-WooCommerce-SMS-OTP-Abraxas-Labs.py <base_url> <victim_username> [new_password]

.venv/bin/python3 CVE-2026-11387-WooCommerce-SMS-OTP-Abraxas-Labs.py \
  https://shop.example \
  admin

A third argument sets the password to apply; the default is abr4x4s#L4b5.

With no arguments the script prints the banner and usage, then exits 1. That is a safe way to confirm the client starts.

Lab preconditions

The target WordPress site must be running SMS Alert ≤ 3.9.5, with OTP-on-reset enabled, and the victim username must already have a phone number for OTP. Against a patched 3.9.6+ site, or a user with no phone, the login check is expected to fail.

Do not point this at any host you do not own or do not have written authorization to test.

Mitigation

• Patch: update SMS Alert to 3.9.6 or later from the WordPress.org plugin directory.
• Temporary workaround: disable OTP verification for password resets until the update is in place. That removes the vulnerable code path.
• After a suspected incident, rotate passwords for any account that had a phone number on file (especially administrators), review users and plugins, and treat wp-admin sessions from the relevant window as untrusted.

References

• CVE-2026-11387
• Wordfence advisory
• NVD
• GitHub Advisory GHSA-ggpj-jphc-wmc4
• Plugin source, 3.9.5: class-ultimatemember.php (Trac)

Disclaimer

Research and educational use only. Do not run, deploy, or use this material against any host unless you have explicit written permission from both the party hosting this repository and the owner of the target systems.

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxas_null