What is the CVSS score of CVE-2026-54802?

CVE-2026-54802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of SMS Alert Order Notifications are affected by CVE-2026-54802?

The SMS Alert Order Notifications WordPress plugin (versions 3.9.3 and earlier) contains an authentication bypass vulnerability (CVE-2026-54802) that allows unauthenticated attackers to access order…

How to fix or mitigate CVE-2026-54802?

Within 24 hours: Inventory all WordPress installations using SMS Alert Order Notifications ≤3.9.3 and immediately disable the plugin. Within 7 days: Review server and application logs from the past 30 days for suspicious access to the plugin's endpoints; conduct data inventory to identify what order/customer information is exposed. Within 30 days: Evaluate alternative order notification solutions and establish a remediation roadmap; monitor Patchstack for vendor patch release.

SMS Alert Order Notifications CVE-2026-54802

EUVD-2026-37638 HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

Authentication Bypass Sms Alert Order Notifications

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Plugin endpoint is reachable over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); broken authorization exposes restricted data only, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:54 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

AnalysisAI

Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenticated attackers to access functionality or data that should be restricted to authenticated users. The flaw, reported by Patchstack and tracked under CWE-862 (Missing Authorization), carries a CVSS 7.5 with high confidentiality impact only. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with SMS Alert plugin

Delivery

Send crafted unauthenticated HTTP request

Exploit

Bypass missing authorization check

Execution

Invoke privileged plugin endpoint

Impact

Exfiltrate restricted data

Access

Identify WordPress site with SMS Alert plugin

Delivery

Send crafted unauthenticated HTTP request

Exploit

Bypass missing authorization check

Execution

Invoke privileged plugin endpoint

Impact

Exfiltrate restricted data

Vulnerability AssessmentAI

Exploitation	Target must be running WordPress with the SMS Alert Order Notifications plugin (by Cozy Vision Technologies) installed and active at version 3.9.3 or earlier, and the vulnerable plugin endpoint must be reachable over the network (typical default for any internet-facing WordPress install). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a network-reachable, low-complexity, unauthenticated, no-user-interaction issue with high confidentiality impact and no integrity or availability impact, consistent with information disclosure via a broken authorization check rather than full account takeover or RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker discovers a WordPress/WooCommerce site running SMS Alert Order Notifications <= 3.9.3, then issues unauthenticated HTTP requests directly to the plugin's vulnerable AJAX or REST endpoint to retrieve data or trigger functionality that should require an authenticated administrator session. Because the flaw is network-reachable, low-complexity, and requires no user interaction, the request can be sent by an automated scanner against any reachable site at scale.
Remediation	Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade SMS Alert Order Notifications to the latest release published after 3.9.3 by Cozy Vision Technologies once available on the WordPress plugin repository, consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-3-broken-authentication-vulnerability for the fixed version. … Detailed patch versions, workarounds, and compensating controls in full report.