{"id":"CVE-2026-94257","aliases":[],"cve":{"records":[{"id":"CVE-2026-94257","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-21T09:02:44.776Z","published":"2026-10-10T06:00:10.247Z","modified":"2026-11-06T10:34:25.362Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-11-06T10:34:25.362Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-10T12:06:40.833Z"}],"references":[{"url":"https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-269","description":"CWE-269 Improper Privilege Management","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-10T12:00:57.473404Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset","titleSource":"WPScan","descriptionSource":"WPScan","description":"The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.","score":8.1,"severity":"high","published":"2026-10-10T06:00:10.247Z","modified":"2026-11-06T10:34:25.362Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"SMS Alert","platforms":[],"versions":[{"version":"3.9.6","status":"affected","lessThan":"4.0.3","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-94257"}],"remediation":[],"references":["https://wpscan.com/vulnerability/4c32fa5b-4677-4f62-8856-fbe9c601fc36/"],"sources":[{"name":"CVE","id":"CVE-2026-94257","modified":"2026-11-06T10:34:25.362Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94257"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"sourceAffected":[],"observedAt":"2026-11-06T11:31:15.364Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T11:35:36.911Z","attemptedAt":"2026-11-06T11:35:36.911Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T11:35:37.808Z","attemptedAt":"2026-11-06T11:35:37.808Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T11:35:36.672Z","attemptedAt":"2026-11-06T11:35:36.672Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T11:35:36.857Z","attemptedAt":"2026-11-06T11:35:36.857Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-96133","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96133","modified":"Nov 6, 2026, 10:34:25 AM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T11:35:36.672Z"},{"source":"FIRST EPSS","id":"CVE-2026-94257","url":"https://www.first.org/epss/","probability":0.00226,"percentile":0.13442,"date":"2026-11-05","checkedAt":"2026-11-06T11:35:36.857Z"},{"source":"NVD","id":"CVE-2026-94257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94257","modified":"2026-11-06T11:17:22.163","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T11:35:36.911Z"},{"source":"GitHub Advisory Database","id":"GHSA-vphv-2c5j-m636","url":"https://github.com/advisories/GHSA-vphv-2c5j-m636","modified":"2026-10-10T12:30:26Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T11:35:37.808Z"}],"aiSummary":{"text":"The SMS Alert WordPress plugin, versions 3.9.6 to 4.0.2, has an unauthenticated privilege escalation weakness via arbitrary password reset. An attacker can set a new password on any account by verifying a one-time code sent to a controlled phone number. This affects administrator accounts.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T11:36:06.979Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-94257"}]}}