This text was generated using artificial intelligence (AI).Update July 29, 2026: In addition, CVE-2025-10656 (CVSS 9.8) was disclosed in the „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ plugin. Due to a lack of authorization checks, this vulnerability allows unauthenticated attackers to gain unauthorized access to administrative functions. See below for details.
Update July 30, 2026: In addition, CVE-2026-3141 (CVSS 9.1) was discovered in the „FormGent – Next-Gen AI Form Builder for WordPress“ plugin. Due to a lack of permission checks, this vulnerability allows unauthenticated attackers to delete any files on the server. A patch is available in version 1.10.0. See below for details.
Update July 31, 2026: In addition, CVE-2026-8457 (CVSS 9.8) was discovered in the „WooCommerce – Social Login“ plugin. The vulnerability allows an authentication bypass in all versions up to and including 2.8.7. See below for details.
On July 28, 2026, a critical vulnerability was discovered in the WordPress plugin „SMS Alert“ with a CVSS score of 9.8 published. The vulnerability, cataloged as CVE-2026-15014 (according to Wordfence CNA), allows an authentication bypass that can lead to a complete account takeover. Affected are e-commerce websites that use the plugin in conjunction with WooCommerce for SMS notifications and one-time password (OTP) verification. Attackers do not need prior access to the system and can exploit the vulnerability remotely.
CVSS Scores:9.8 (Critical) for CVE-2026-15014, CVE-2026-8457, and CVE-2025-10656, 9.1 (Critical) for CVE-2026-3141
Affected software:
WordPress plugin „SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery“ in all versions up to and including 3.9.7 (CVE-2026-15014)
WordPress plugin „WooCommerce – Social Login“ in all versions up to and including 2.8.7 (CVE-2026-8457)
WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ in all versions up to and including 2.4.37 (CVE-2025-10656)
WordPress plugin „FormGent – Next-Gen AI Form Builder for WordPress“ in all versions up to and including 1.9.2 (CVE-2026-3141)
Patch Status:
CVE-2026-15014: As of the date of this publication (July 28, 2026), no official patch has been confirmed.
CVE-2026-8457: As of the date of this publication (July 31, 2026), no official patch has been confirmed.
CVE-2025-10656: As of the date of this publication (July 29, 2026), no official patch has been confirmed.
CVE-2026-3141: Patch available in version 1.10.0 (as of July 30, 2026).
Risk: Unauthorized takeover of any user accounts (CVE-2026-15014, CVE-2026-8457), unauthorized access to administrative functions (CVE-2025-10656), and unauthorized deletion of arbitrary files (CVE-2026-3141) by external attackers.
Technical Background: CVE-2026-15014 (SMS Alert)
The cause of CVE-2026-15014 is a logical error within the registration process that handles OTP verification via SMS. An attacker can exploit this error to log in as any user whose phone number is known or can be guessed.
The attack takes place in two steps:
The attacker initiates the registration process using a phone number under their control and successfully completes the OTP verification. The plugin then sets a session variable ($_SESSION[’sa_mobile_verified‘]) on true, to record the successful completion of the exam.
The crucial mistake is that this true-status is not tied to a specific phone number. The attacker can now trigger the registration process again, but this time using a victim's phone number in the parameter billing_phone. Since the session variable is already set, the flawed logic skips another OTP check and issues an authentication cookie for the victim's account.
This process allows the attacker to gain complete control over the user's account without ever having had access to the victim's phone.
It is worth noting that a structurally related vulnerability in the same plugin had already been disclosed about a month earlier (published: July 1, 2026): CVE-2026-11387 affected versions up to and including 3.9.5 and also allowed unauthenticated account takeover, in that case via a faulty password reset mechanism. This underscores the importance of continuously monitoring third-party plugins as part of a structured vendor risk management process.
Technical Background: CVE-2026-8457 (WooCommerce – Social Login)
CVE-2026-8457 affects the WordPress plugin „WooCommerce – Social Login“ in all versions up to and including 2.8.7. The vulnerability is classified as an authentication bypass and has a CVSS score of 9.8 (critical).
The vulnerability allows unauthenticated attackers to bypass the plugin's authentication mechanisms and gain access to user accounts without valid login credentials. The attack vector is network-based (AV:N), requires no user interaction (UI:N), and no prior privileges (PR:N), making exploitation particularly easy. The impact on confidentiality, integrity, and availability is rated as high (C:H/I:H/A:H) in each case.
As of the date of this publication (July 31, 2026), no official patch is available. Site administrators should temporarily disable the plugin until a security update is released.
CVE-2025-10656 affects the WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ in all versions up to and including 2.4.37. The vulnerability is classified as “Missing Authorization” and has been assigned a CVSS score of 9.8 (critical).
The gap lies in the user_filter-Function of the plugin. Due to missing or insufficient authorization checks, unauthenticated attackers can invoke and execute administrative functions of the plugin. This potentially allows for the manipulation of product prices, access to sensitive configuration data, or other privileged operations that should normally be reserved for authenticated administrators.
The attack vector is network-based (AV:N), requires no user interaction (UI:N) and no prior privileges (PR:N), which makes exploitation particularly easy. The impact on confidentiality, integrity, and availability is rated as high in each case (C:H/I:H/A:H).
Technical Background: CVE-2026-3141 (FormGent)
CVE-2026-3141 affects the WordPress plugin „FormGent – Next-Gen AI Form Builder for WordPress“ in all versions up to and including 1.9.2. The vulnerability has a CVSS score of 9.1 (critical) and allows unauthorized deletion of any files on the server.
The cause is a missing capability check at the REST API endpoint /wp-json/formgent/responses/attachments. This endpoint should only be accessible to authenticated users with the appropriate permissions, but it has been implemented without any authorization checks. Unauthenticated attackers can directly access this endpoint and delete any files from the server by sending targeted requests.
The attack vector is network-based (AV:N), requires no user interaction (UI:N), and no prior privileges (PR:N). The impact on integrity and availability is rated as high (I:H/A:H), while confidentiality is not directly affected (C:N). A successful attack can result in the deletion of critical system files, configuration files, or user data, thereby significantly impairing the functionality of the WordPress installation.
An official patch for CVE-2026-3141 has been available since version 1.10.0. Administrators should update to this version immediately.
Recommended Actions
Organizations using any of the affected plugins should take immediate action to prevent exploitation of the vulnerabilities.
Immediate measures:
Check plugin status:
For CVE-2026-15014, CVE-2026-8457, and CVE-2025-10656: As of the date of this publication (July 28, 29, and 31, 2026), no official patches are known to exist. Check the WordPress Plugin Directory Check regularly for available updates.
For CVE-2026-3141: Update the „FormGent“ plugin immediately to version 1.10.0 or later.
Workaround for CVE-2026-15014: Temporarily disable the OTP-based registration feature in the WooCommerce settings until an official patch is available and can be applied.
Workaround for CVE-2026-8457: Completely disable the „WooCommerce – Social Login“ plugin until a security update is available. Explore alternative solutions for social login functionality.
Workaround for CVE-2025-10656: Completely deactivate the „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light“ plugin until a security update is available. Explore alternative solutions for price management.
Workaround for CVE-2026-3141 (if an update is not immediately possible): Please completely deactivate the „FormGent“ plugin until the update to version 1.10.0 can be installed.
Short-term measures:
System Check: Identify and prioritize all systems on which the vulnerable plugins are installed.
Log Analysis: Check the server and application logs for suspicious activity:
For CVE-2026-15014: Registration attempts using manipulated billing_phone-parameters
For CVE-2026-8457: Unusual authentication attempts via social login endpoints without the appropriate OAuth flows
For CVE-2025-10656: Unusual access to the user_filter-Functions or administrative endpoints without proper authentication
For CVE-2026-3141: Unusual access to the REST API endpoint /wp-json/formgent/responses/attachments, particularly DELETE queries from unauthenticated sources
Long-term measures:
Continuous Monitoring: Establish processes for continuous vulnerability and vendor risk management to systematically identify and assess risks associated with third-party software.
DACH Relevance and Regulatory Classification
For companies in the DACH region that operate WooCommerce stores containing customer data, a successful exploitation of these vulnerabilities may constitute a reportable data breach under Article 33 of the GDPR — the competent supervisory authority must generally be notified within 72 hours if there is a risk to the rights and freedoms of data subjects. Companies subject to NIS 2 should also verify whether the plugins are included and assessed as part of their mandatory vulnerability management process. The BSI generally recommends including third-party components, such as WordPress plugins, in the company’s own asset inventory and continuously monitoring their patch status.
Classification Using External Attack Surface Management (EASM)
Vulnerabilities in externally accessible components, such as WordPress plugins, pose a significant risk because they often go unnoticed—especially in complex IT environments or when they are part of shadow IT: Plugins that have been installed independently by individual teams or business units often do not appear in the central asset inventory and are therefore not covered by regular patch management.
An External Attack Surface Management (EASM) platform like LocateRisk helps companies gain the necessary visibility into their external systems. By continuously scanning the attack surface, it automatically identifies the technologies and software components in use—such as the „SMS Alert“ plugin, the „WooCommerce – Social Login“ plugin, the „Spreadsheet Price Changer“ plugin, or the „FormGent“ plugin—are automatically identified, even if they are not centrally documented. This provides security teams with a robust inventory of all externally exposed assets, enabling them to immediately determine which systems are affected when vulnerabilities such as CVE-2026-15014, CVE-2026-8457, CVE-2025-10656, or CVE-2026-3141—are disclosed, they can immediately determine which systems are affected. At the same time, continuous monitoring enables the early detection of configuration drift and newly emerging exposures before they are actively exploited.
The LocateRisk solution is hosted in certified German data centers and supports compliance with GDPR requirements, which contributes to companies' digital sovereignty.
CVE-2026-15014 is a critical vulnerability (CVSS 9.8) in the WordPress plugin „SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery.“ It allows unauthenticated attackers to bypass the OTP verification process and gain full control over any user accounts, including administrator accounts.
CVE-2026-8457 is a critical vulnerability (CVSS 9.8) in the WordPress plugin „WooCommerce – Social Login.“ The vulnerability allows an authentication bypass in all versions up to and including 2.8.7 and enables unauthenticated attackers to gain access to user accounts without valid login credentials.
CVE-2025-10656 is a critical security vulnerability (CVSS 9.8) in the WordPress plugin „Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light.“ The vulnerability stems from a lack of authorization checks in the user_filter-function and allows unauthenticated attackers to access the plugin's administrative functions.
CVE-2026-3141 is a critical vulnerability (CVSS 9.1) in the WordPress plugin „FormGent – Next-Gen AI Form Builder for WordPress.“ The vulnerability stems from a lack of authorization checks at the REST API endpoint /wp-json/formgent/responses/attachments and allows unauthenticated attackers to delete any files on the server. A patch is available in version 1.10.0.
For CVE-2026-15014, all versions of the „SMS Alert“ plugin up to and including version 3.9.7 are affected. All versions of the „WooCommerce – Social Login“ plugin up to and including version 2.8.7 are affected by CVE-2026-8457. All versions of the „Spreadsheet Price Changer“ plugin up to and including version 2.4.37 are affected by CVE-2025-10656. For CVE-2026-3141, all versions of the „FormGent“ plugin up to and including version 1.9.2 are affected. As of the publication of this analysis (July 28, 29, 30, and 31, 2026), there are no known official patches for CVE-2026-15014, CVE-2026-8457, and CVE-2025-10656. A patch is available for CVE-2026-3141 in version 1.10.0. Check the WordPress Plugin Directory regularly for available updates.
For CVE-2026-15014, the recommended immediate workaround is to disable the OTP-based registration feature in the WooCommerce settings. For CVE-2026-8457, the „WooCommerce – Social Login“ plugin should be completely disabled. For CVE-2025-10656, the affected plugin should be completely disabled. For CVE-2026-3141, you should immediately update to version 1.10.0; if this is not possible right away, completely deactivate the plugin. In addition, server and application logs should be checked for suspicious activity.
CVE-2026-11387 (published July 1, 2026) affected versions up to and including 3.9.5 and exploited a flawed password reset mechanism. CVE-2026-15014 affects versions up to and including 3.9.7 and describes another attack vector via the processRegistration()-function and the billing_phone-parameter. Both vulnerabilities allow for a complete account takeover without prior authentication.
As of August 2, 2026. This article is intended for general informational purposes only and does not constitute legal, security, or operational advice in specific cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee that the information is up-to-date, accurate, or complete.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2024-3094
Passive Assessment
Information About the CVENotes found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français