This text was generated using artificial intelligence (AI).Update July 29, 2026: In addition, CVE-2025-10656 (CVSS 9.8) was disclosed in the „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ plugin. Due to a lack of authorization checks, this vulnerability allows unauthenticated attackers to gain unauthorized access to administrative functions. See below for details.
On July 28, 2026, a critical vulnerability was discovered in the WordPress plugin „SMS Alert“ with a CVSS score of 9.8 published. The vulnerability, cataloged as CVE-2026-15014 (according to Wordfence CNA), allows an authentication bypass that can lead to a complete account takeover. Affected are e-commerce websites that use the plugin in conjunction with WooCommerce for SMS notifications and one-time password (OTP) verification. Attackers do not need prior access to the system and can exploit the vulnerability remotely.
CVSS Scores:9.8 (Critical) for both vulnerabilities
Affected software:
WordPress plugin „SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery“ in all versions up to and including 3.9.7 (CVE-2026-15014)
WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ in all versions up to and including 2.4.37 (CVE-2025-10656)
Patch Status: As of the date of this publication (July 28–29, 2026), no official patches for CVE-2026-15014 and CVE-2025-10656 have been confirmed. Check the WordPress Plugin Directory regularly for new versions.
Risk: Unauthorized takeover of any user accounts (CVE-2026-15014) and unauthorized access to administrative functions (CVE-2025-10656) by external attackers.
Technical Background: CVE-2026-15014 (SMS Alert)
The cause of CVE-2026-15014 is a logical error within the registration process that handles OTP verification via SMS. An attacker can exploit this error to log in as any user whose phone number is known or can be guessed.
The attack takes place in two steps:
The attacker initiates the registration process using a phone number under their control and successfully completes the OTP verification. The plugin then sets a session variable ($_SESSION[’sa_mobile_verified‘]) on true, to record the successful completion of the exam.
The crucial mistake is that this true-status is not tied to a specific phone number. The attacker can now trigger the registration process again, but this time using a victim's phone number in the parameter billing_phone. Since the session variable is already set, the flawed logic skips another OTP check and issues an authentication cookie for the victim's account.
This process allows the attacker to gain complete control over the user's account without ever having had access to the victim's phone.
It is worth noting that a structurally related vulnerability in the same plugin had already been disclosed about a month earlier (published: July 1, 2026): CVE-2026-11387 affected versions up to and including 3.9.5 and also allowed unauthenticated account takeover, in that case via a faulty password reset mechanism. This underscores the importance of continuously monitoring third-party plugins as part of a structured vendor risk management process.
CVE-2025-10656 affects the WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ in all versions up to and including 2.4.37. The vulnerability is classified as “Missing Authorization” and has been assigned a CVSS score of 9.8 (critical).
The gap lies in the user_filter-Function of the plugin. Due to missing or insufficient authorization checks, unauthenticated attackers can invoke and execute administrative functions of the plugin. This potentially allows for the manipulation of product prices, access to sensitive configuration data, or other privileged operations that should normally be reserved for authenticated administrators.
The attack vector is network-based (AV:N), requires no user interaction (UI:N) and no prior privileges (PR:N), which makes exploitation particularly easy. The impact on confidentiality, integrity, and availability is rated as high in each case (C:H/I:H/A:H).
Recommended Actions
Organizations using any of the affected plugins should take immediate action to prevent exploitation of the vulnerabilities.
Immediate measures:
Check plugin status: As of the date of this publication, there are no known official patches for CVE-2026-15014 and CVE-2025-10656. Check the WordPress Plugin Directory Check for newly released versions and install them as soon as updates are available.
Workaround for CVE-2026-15014: Temporarily disable the OTP-based registration feature in the WooCommerce settings until an official patch is available and can be applied.
Workaround for CVE-2025-10656: Completely deactivate the „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ plugin until a security update is available. Explore alternative solutions for price management.
Short-term measures:
System Check: Identify and prioritize all systems on which the vulnerable plugins are installed.
Log Analysis: Check the server and application logs for suspicious activity:
For CVE-2026-15014: Registration attempts using manipulated billing_phone-parameters
For CVE-2025-10656: Unusual access to the user_filter-Functions or administrative endpoints without proper authentication
Long-term measures:
Continuous Monitoring: Establish processes for continuous vulnerability and vendor risk management to systematically identify and assess risks associated with third-party software.
DACH Relevance and Regulatory Classification
For companies in the DACH region that operate WooCommerce stores containing customer data, a successful exploitation of these vulnerabilities may constitute a reportable data breach under Article 33 of the GDPR — the competent supervisory authority must generally be notified within 72 hours if there is a risk to the rights and freedoms of data subjects. Companies subject to NIS 2 should also verify whether the plugins are included and assessed as part of their mandatory vulnerability management process. The BSI generally recommends including third-party components, such as WordPress plugins, in the company’s own asset inventory and continuously monitoring their patch status.
Classification Using External Attack Surface Management (EASM)
Vulnerabilities in externally accessible components, such as WordPress plugins, pose a significant risk because they often go unnoticed—especially in complex IT environments or when they are part of shadow IT: Plugins that have been installed independently by individual teams or business units often do not appear in the central asset inventory and are therefore not covered by regular patch management.
An External Attack Surface Management (EASM) platform such as LocateRisk helps companies gain the necessary visibility into their external systems. By continuously scanning the attack surface, deployed technologies and software components—such as the „SMS Alert“ plugin or the „Spreadsheet Price Changer“ plugin—are automatically identified, even if they are not centrally documented. This provides security teams with a robust inventory of all externally exposed assets, enabling them to immediately determine which systems are affected when vulnerabilities such as CVE-2026-15014 or CVE-2025-10656 are disclosed. At the same time, continuous monitoring enables the early detection of configuration drift and newly emerging exposures before they are actively exploited.
The LocateRisk solution is hosted in certified German data centers and supports compliance with GDPR requirements, which contributes to companies' digital sovereignty.
CVE-2026-15014 is a critical vulnerability (CVSS 9.8) in the WordPress plugin „SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery.“ It allows unauthenticated attackers to bypass the OTP verification process and gain full control over any user accounts, including administrator accounts.
CVE-2025-10656 is a critical security vulnerability (CVSS 9.8) in the WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light.“ The vulnerability stems from a lack of authorization checks in the user_filter-function and allows unauthenticated attackers to access the plugin's administrative functions.
For CVE-2026-15014, all versions of the „SMS Alert“ plugin up to and including version 3.9.7 are affected. All versions of the „Spreadsheet Price Changer“ plugin up to and including version 2.4.37 are affected by CVE-2025-10656. As of the publication of this analysis (July 28–29, 2026), no official patches are known to exist. Check the WordPress Plugin Directory regularly for available updates.
For CVE-2026-15014, the recommended immediate workaround is to disable the OTP-based registration feature in the WooCommerce settings. For CVE-2025-10656, the affected plugin should be completely disabled. In addition, server and application logs should be checked for suspicious activity.
CVE-2026-11387 (published July 1, 2026) affected versions up to and including 3.9.5 and exploited a flawed password reset mechanism. CVE-2026-15014 affects versions up to and including 3.9.7 and describes another attack vector via the processRegistration()-function and the billing_phone-parameter. Both vulnerabilities allow for a complete account takeover without prior authentication.
As of July 29, 2026. This article is intended for general informational purposes only and does not constitute legal, security, or operational advice in specific cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee that the information is up-to-date, accurate, or complete.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2024-3094
Passive Assessment
Information About the CVENotes found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français