CVE-2026-15206

The CVE concerns the SMS Alert WordPress plugin (versions before 3.9.8). The vulnerability arises because the plugin does not bind the user’s real verified mobile session to the verified phone number; after OTP verification, the signup/login handler uses an attacker-supplied phone number to selec...