CVE-2026-94258 in SMS Alert Plugin
Summary
by MITRE • 10/08/2026
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in versions of the SMS Alert WordPress plugin prior to version 4.0.1 represents a critical authorization flaw within the context of WordPress multisite installations. This issue stems from an insufficient access control mechanism that fails to validate whether the currently authenticated administrator possesses the necessary privileges to manage specific user accounts before exposing sensitive personal data. Specifically, when an administrator interacts with features designed to retrieve or display billing information for users associated with SMS services, the application logic does not verify if the acting admin is authorized to oversee those particular users. This oversight allows any administrator within a multisite network to bypass intended isolation boundaries and access private contact details belonging to users on different sites hosted under the same WordPress installation.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference (IDOR) combined with Broken Access Control vulnerabilities as defined by industry standards such as CWE-639 and CWE-284 respectively. The core issue lies in the server-side processing of requests where user identifiers are accepted without rigorous permission checks against the multisite role hierarchy. In a standard single-site WordPress environment, this might not pose a significant risk since administrators typically have full control over all users on that site. However, in a multisite architecture, distinct sites operate with separate administrative scopes to maintain data segregation and privacy compliance. The plugin's failure to enforce these boundaries effectively breaks the trust model of the network, allowing lateral movement across site boundaries for information disclosure purposes.
The operational impact of this vulnerability is primarily centered on the unauthorized disclosure of Personally Identifiable Information (PII). By exploiting this flaw, an attacker with administrative access to one site can harvest phone numbers associated with billing accounts from other sites within the same multisite network. This exposure not only violates user privacy expectations but also potentially breaches regulatory compliance frameworks such as GDPR or CCPA, which mandate strict controls over personal data handling and sharing. Furthermore, having access to these phone numbers could facilitate further attacks, including social engineering campaigns, SMS-based phishing (smishing), or account takeover attempts if the phone number is used for two-factor authentication on other platforms linked to those users.
It is important to note that this vulnerability requires specific conditions to be successfully exploited. The attacker must possess administrative credentials for at least one site within the multisite network and have access to stored gateway credentials, which are typically saved in the database or configuration files of their own site. This requirement limits the attack surface slightly but does not mitigate the severity given that administrators often hold elevated privileges across multiple sites due to convenience or organizational structure. The presence of these credentials suggests a broader compromise scenario where an attacker has already gained initial access and is now leveraging privilege escalation techniques to extract valuable intelligence from adjacent network segments.
To remediate this issue, it is imperative for site owners to upgrade the SMS Alert WordPress plugin to version 4.0.1 or later immediately upon availability. This update includes patches that enforce proper authorization checks before returning sensitive user data. In addition to updating the software, administrators should review their multisite network configurations to ensure that role assignments are strictly aligned with least privilege principles. Regular audits of administrative access rights can help identify users who may have excessive permissions across multiple sites. Furthermore, implementing Web Application Firewall rules or custom code snippets that validate user capabilities against specific resource ownership before processing sensitive queries can provide an additional layer of defense against similar IDOR vulnerabilities in other plugins or core functionalities.