EUVD-2026-103302
GHSA-gc49-fvfx-j252
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactPerform unauthorized modification of plugin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated WordPress session at a low privilege level (CVSS PR:L) on a site running SMS Alert Order Notifications version 4.0.1 or earlier, where the vulnerable action endpoint omits a proper capability/authorization check. Limiting factors: the attacker must already hold an account (no unauthenticated/anonymous path, so PR:N does not apply), impact is confined to integrity (I:L) with no confidentiality or availability effect, and exploitation presupposes the plugin is installed and active - typically alongside WooCommerce. No user interaction is required (UI:N). |
| Impact | This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nevertheless requires an already-authenticated low-privilege account (PR:L) and yields only limited integrity impact with no confidentiality or availability loss. CWE-862 (Missing Authorization) and the Patchstack reference title ('Broken Access Control') corroborate that the core problem is a missing capability/authorization check rather than full authentication bypass, despite the 'Authentication Bypass' tag. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so exploitation-probability signals are absent rather than confirmed low. SSVC-style framing: exploitation status is 'none observed', technical impact is partial (integrity only), and automatability is plausible but unconfirmed. Net: a real but bounded authorization flaw that merits routine patching, not emergency response - the PR:L requirement and integrity-only impact cap its real-world severity well below the critical tier. |
| Exploit ScenarioDerived | An attacker who holds any low-privilege authenticated WordPress account (e.g., a subscriber or WooCommerce customer) sends a crafted request to a plugin endpoint that fails to verify the caller's capability, allowing them to perform an action or alter plugin data they should not be able to reach. No public exploit code was identified at time of analysis, and the CVSS integrity-only, low impact (I:L, C:N/A:N) limits the result to unauthorized modification rather than data theft or full site takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 17, 2026
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis, so the only confirmed remediation is to disable and remove the SMS Alert Order Notifications plugin until Cozy Vision publishes a corrected release; check the Patchstack advisory linked above for updates. If the plugin must stay active, compensate with role hardening: audit and prune low-privilege accounts, disable open 'Anyone can register' enrollment on WooCommerce storefronts, and ensure new accounts default to Subscriber with no shop-manager capabilities, since that account tier is the entry point the PR:L vector assumes. Add a WAF or virtual-patch rule that blocks the plugin's admin-ajax/REST notification actions for users lacking manage_woocommerce or manage_options, understanding that legitimate low-privilege integrations would break if they rely on those routes. Log and alert on notification-configuration changes made by Subscriber- or Customer-level users. Trade-offs: deactivating the plugin suspends all order SMS alerts, and WAF blocking can produce false positives for custom front-end flows; neither substitutes for a vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-862 (Missing Authorization) in a WordPress plugin context generally means an AJAX handler, REST route, or admin-post action is registered without a corresponding current_user_can() capability check, or with a check that validates a nonce without validating the caller's role. The plugin's purpose is to send SMS notifications for WooCommerce order events, so the affected endpoints govern notification configuration and dispatch - operations that should require manage_options or manage_woocommerce capabilities. The tags supplied by the reporter include 'Authentication Bypass', but the assessed vector (PR:L) confirms this is an access-control/privilege-tier gap rather than an anonymous bypass: any self-registered subscriber or customer-level account can reach an action intended for shop staff. The CPE (cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications) covers all versions up to and including 4.0.1, with no version-range boundary below the affected ceiling. WordPress's shared hosting model amplifies the practical relevance, since open registration on WooCommerce storefronts is common and supplies exactly the low-privilege foothold the vector presumes.
Know when Sms Alert Order Notifications gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Missing authorization reachable over the network by any logged-in low-privilege user, so AV:N/AC:L/PR:L/UI:N; impact is limited unauthorized modification, giving I:L with C:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerabilit
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to privilege escalation via account t
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and ear
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allo
Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision Techno
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insuff
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated s
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network
SQL injection in the Cozy Vision 'SMS Alert Order Notifications - WooCommerce' WordPress plugin (all versions up to and
Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenti
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th
Exploit-DB