What is the CVSS score of CVE-2026-54803?

CVE-2026-54803 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of SMS Alert Order Notifications are affected by CVE-2026-54803?

The SMS Alert Order Notifications WordPress plugin (versions ≤3.9.4) contains a critical authorization bypass (CVSS 9.8) that enables any Subscriber-level user to escalate privileges to full…

How to fix or mitigate CVE-2026-54803?

Within 24 hours: audit all WordPress installations for SMS Alert Order Notifications plugin versions 3.9.4 and earlier; immediately disable or remove the plugin from all affected sites; review WordPress security audit logs for evidence of unauthorized privilege escalations by Subscriber-level accounts. Within 7 days: reset all WordPress administrator account credentials; audit Subscriber-level user activities and account modifications from the past 60 days; implement WordPress user capability restrictions limiting what Subscriber-role users can perform. Within 30 days: deploy alternative order notification solutions not dependent on this plugin; monitor Cozy Vision Technologies vendor advisories for a patched version; establish continuous monitoring for WordPress administrative account creation anomalies.

SMS Alert Order Notifications CVE-2026-54803

EUVD-2026-37639 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-17 Patchstack

WordPress Authentication Bypass Privilege Escalation Sms Alert Order Notifications Wordpress Plugin Cozy Vision Technologies Pvt Ltd

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Subscriber role is required to reach the vulnerable endpoint, so PR:L (not PR:N); network-reachable HTTP, no user interaction, and full admin takeover yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:53 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

AnalysisAI

Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4 and earlier allows low-privileged users - specifically Subscriber-level accounts - to elevate their permissions on the WordPress site. Patchstack catalogued this as an authorization/authentication-bypass class issue (CWE-863). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (CPE: cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications) that integrates SMS notifications with WooCommerce-style order events. The root cause class is CWE-863 (Incorrect Authorization), meaning the plugin exposes one or more administrative actions over the WordPress AJAX/REST surface without verifying that the requesting user holds the required capability. In WordPress plugins, this typically manifests as missing current_user_can() checks or reliance on nonces alone, allowing any logged-in user (including the default Subscriber role created by open registration) to invoke privileged handlers.

RemediationAI

Upgrade the SMS Alert Order Notifications plugin to any version released after 3.9.4 once the vendor publishes a fix; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-4-privilege-escalation-vulnerability) is the authoritative source for the patched version and should be monitored. Until a patched release is independently confirmed, the most effective compensating control is to deactivate the plugin entirely on production sites, which will stop SMS order notifications but eliminates the attack surface; if that is not acceptable, disable open user registration in WordPress (Settings → General → 'Anyone can register' off) to remove the unauthenticated path, and use a virtual-patching WAF such as Patchstack or Wordfence to block the vulnerable plugin endpoints (which will degrade gracefully if the WAF signature is imprecise). Additionally, audit existing low-privilege accounts and recently elevated administrators for signs of misuse.