What is the CVSS score of CVE-2026-54802?

CVE-2026-54802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of SMS Alert Order Notifications are affected by CVE-2026-54802?

The SMS Alert Order Notifications WordPress plugin (versions 3.9.3 and earlier) contains an authentication bypass vulnerability (CVE-2026-54802) that allows unauthenticated attackers to access order…

How to fix or mitigate CVE-2026-54802?

Within 24 hours: Inventory all WordPress installations using SMS Alert Order Notifications ≤3.9.3 and immediately disable the plugin. Within 7 days: Review server and application logs from the past 30 days for suspicious access to the plugin's endpoints; conduct data inventory to identify what order/customer information is exposed. Within 30 days: Evaluate alternative order notification solutions and establish a remediation roadmap; monitor Patchstack for vendor patch release.

SMS Alert Order Notifications CVE-2026-54802

EUVD-2026-37638 HIGH

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Sms Alert Order Notifications Wordpress Plugin Cozy Vision Technologies Pvt Ltd

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Plugin endpoint is reachable over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); broken authorization exposes restricted data only, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:54 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

AnalysisAI

Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenticated attackers to access functionality or data that should be restricted to authenticated users. The flaw, reported by Patchstack and tracked under CWE-862 (Missing Authorization), carries a CVSS 7.5 with high confidentiality impact only. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

The affected component is SMS Alert Order Notifications, a WordPress plugin by Cozy Vision Technologies Pvt. Ltd. used by WooCommerce/WordPress site operators to send SMS notifications for order events. The CPE cpe:2.3:a:cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications confirms the vendor and product. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - typically AJAX actions or REST routes registered by the plugin - fail to enforce a capability check or nonce validation before performing a privileged operation or returning sensitive data, allowing requests from unauthenticated sources to be processed as if authorized.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade SMS Alert Order Notifications to the latest release published after 3.9.3 by Cozy Vision Technologies once available on the WordPress plugin repository, consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-3-broken-authentication-vulnerability for the fixed version. Until the plugin can be upgraded, deactivate and remove the SMS Alert Order Notifications plugin (which will disable order SMS notifications), or place the affected endpoints behind a WAF rule that blocks unauthenticated requests to the plugin's AJAX/REST routes (trade-off: may break any legitimate front-end integrations that the plugin exposes). Restricting access to /wp-admin/admin-ajax.php and /wp-json/ paths via IP allowlisting on staging sites, and ensuring the plugin is not active on internet-exposed environments, are additional compensating controls.