SMS Alert Order Notifications CVE-2025-26984

Exploitation requires the victim to click a specially crafted malicious link while authenticated to the WordPress admin dashboard or WooCommerce management interface. The vulnerable SMS Alert Order Notifications plugin must be installed and activated on the target WordPress site (versions through 3.7.8). No special plugin configuration settings or non-default features are required - the vulnerability exists in the plugin's default input handling for reflected parameters. Attack vector is network-based (AV:N) requiring no authentication from the attacker's perspective (PR:N), but critically depends on mandatory user interaction (UI:R) through social engineering to deliver the malicious payload URL. Exploitation success is limited by the victim's privilege level - while any authenticated user clicking the link may execute the XSS payload, meaningful impact (such as administrative action or data theft) requires the victim to hold WordPress editor, shop manager, or administrator roles with access to sensitive WooCommerce data or configuration capabilities.

Real-world risk is moderate despite the 7.1 CVSS score. The CVSS vector shows network accessibility (AV:N) and low attack complexity (AC:L) but critically requires user interaction (UI:R) and no authentication (PR:N), making exploitation dependent on social engineering effectiveness. The changed scope (S:C) elevates the score by accounting for cross-domain impact, but practical exploitation requires convincing users to click malicious links. The 0.08% EPSS score (25th percentile) indicates security researchers have not observed significant exploitation attempts in the wild. Absence from CISA KEV confirms no federal agency has detected active widespread exploitation as of analysis date. Patchstack's disclosure by audit@patchstack.com suggests this was identified through security research rather than incident response, further supporting lower immediate threat. Priority should be moderate for WordPress sites using this WooCommerce plugin, with remediation urgency increasing if the plugin handles sensitive transaction data or if the site has high-privilege admin users who might be targeted. The combination of UI requirement and low EPSS make this lower priority than network-exploitable RCE vulnerabilities, but higher than purely authenticated or local XSS flaws.

An attacker crafts a malicious URL containing JavaScript payloads in parameters processed by the SMS Alert plugin's order notification interface, then distributes this link via phishing emails disguised as WooCommerce order confirmations or customer support requests. When a logged-in WordPress administrator or shop manager clicks the link to investigate the purported order issue, the unvalidated input reflects into the page response, executing the attacker's JavaScript in the victim's browser session. The malicious script harvests WordPress authentication cookies, CSRF tokens, or administrative session data, then exfiltrates credentials to attacker-controlled infrastructure, potentially enabling account takeover of privileged WooCommerce store accounts. No public proof-of-concept code is confirmed in available references, but reflected XSS exploitation techniques are well-documented and require minimal technical sophistication once vulnerable parameters are identified.