{"vulnerability": "CVE-2026-94256", "sightings": [{"uuid": "e63b731b-df5e-4ae6-a65b-5ee343dbae66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94256", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415134343257518", "content": "CVE-2026-94256 SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP The SMS Alert  WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94256https://wpscan.com/vulnerability/38b4e7f9-d73e-4c4d-bb9c-4c2dd1f4d7d9/#CVE_2026_94256#bot", "creation_timestamp": "2026-10-10T06:12:48.161143Z"}]}