SMS Alert CVE-2026-116386

The target must be running the WordPress plugin 'SMS Alert Order Notifications' by Cozy Vision Technologies at version 4.0.2 or earlier and have it active. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special privileges, and no user interaction are required - exploitation is remote and unauthenticated. The specific feature, endpoint, or configuration that triggers the privilege escalation is not described in the available sources, so beyond having the vulnerable plugin version installed and reachable, no additional limiting prerequisite (non-default configuration, specific platform, or user interaction) is confirmed from the data.

This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, though several corroborating signals are absent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction and high impact to confidentiality, integrity, and availability (9.8 Critical), which aligns with CWE-266 (Improper Privilege Management) manifesting as unauthenticated privilege escalation. The vuln.today decision label is act_now and the finding was reported by Patchstack, a credible WordPress-focused vulnerability source, which supports prioritization. However, no EPSS exploitation-probability score was supplied, the CVE is NOT listed in CISA KEV, and no SSVC automatable/technical-impact breakdown was provided, so widespread or automated exploitation cannot be confirmed from the data - the act_now label here reflects the severity and nature of the flaw plus vendor reporting, not evidence of observed attacks. The only reference is the Patchstack advisory page itself, not verified working exploit code. Net: treat as an urgent patch priority consistent with the act_now decision, while noting that EPSS, KEV, and independent PoC confirmation are all missing.

A remote attacker sends crafted requests to a WordPress site running the SMS Alert Order Notifications plugin (version 4.0.2 or earlier) without needing any account or credentials, abusing the plugin's improper privilege management to elevate their effective privileges. Because the CVSS vector indicates no authentication and no user interaction, this could be scripted against exposed sites; the precise request/trigger is not described in the available sources. No public exploit identified at time of analysis.