CVE-2026-94258

{
  "etk_id": "ETK-2026-1350",
  "cve_id": "CVE-2026-94258",
  "display_id": "CVE-2026-94258",
  "ghsa_id": "GHSA-v3cq-2qmr-2qf3",
  "euvd_id": "EUVD-2026-94753",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in SMS Alert for WordPress",
  "summary": "SMS Alert for WordPress before version 4.0.1 can expose stored billing phone numbers in multisite installations. An administrator of one site may retrieve phone numbers associated with users of other sites when gateway credentials are configured on the administrator's own site.",
  "mitigation": "Upgrade SMS Alert for WordPress to version 4.0.1 or later. Until upgraded, restrict administrator access on affected multisite networks and remove unnecessary gateway credentials from individual sites.",
  "vendor": null,
  "product": "SMS Alert",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.6.4, < 4.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.0.1"
      ],
      "package_name": "SMS Alert",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 2.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0802,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 38.00658811666667,
  "t0_at": "2026-10-08T06:00:09.230000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T12:22:19.196506+00:00",
      "days": 4.265393130856482,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:09.230000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T06:00:09.230000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:09.230000+00:00",
      "url": "https://github.com/advisories/GHSA-v3cq-2qmr-2qf3"
    }
  }
}