What is GHSA-64w6-p26h-qxq4?

GHSA-64w6-p26h-qxq4 is a security advisory published by GitHub Security Advisories with High severity. The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is...

Which CVE IDs does GHSA-64w6-p26h-qxq4 cover?

GHSA-64w6-p26h-qxq4 covers the following CVE IDs: CVE-2026-94256. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-64w6-p26h-qxq4?

GHSA-64w6-p26h-qxq4 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-64w6-p26h-qxq4HighCVSS 8.1

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-94256 →

📋 Description

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-94256
https://wpscan.com/vulnerability/38b4e7f9-d73e-4c4d-bb9c-4c2dd1f4d7d9
https://github.com/advisories/GHSA-64w6-p26h-qxq4