Admin-only phone disclosure via unchecked bulk user selection

SMS Alert before 4.0.1 exposes billing phone numbers to remote authenticated users through WordPress multisite bulk user actions. The bulk user action handler returns stored billing phone numbers for selected users without checking whether the acting administrator is authorized to manage them. Exploitation requires site-administrator access and gateway credentials stored on that administrator's site, and discloses phone numbers belonging to users on other sites in the same network.