EUVD-2026-37639Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRegister Subscriber account via open signup
-
DeliveryAuthenticate to WordPress
-
ExploitSend crafted request to vulnerable plugin endpoint
-
InstallBypass capability check (CWE-863)
-
C2Escalate role to Administrator
-
ExecuteUpload malicious plugin for RCE
-
ImpactFull site and order-data takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SMS Alert Order Notifications plugin (≤ 3.9.4) must be installed and activated on a WordPress site, and the attacker must be able to authenticate as a Subscriber-level user - which on sites with open user registration enabled (a common default for WooCommerce stores) is effectively unauthenticated, because anyone can self-register a Subscriber account. Exploitation is over HTTP/HTTPS with no user interaction and no admin involvement; what limits it is (a) sites that have disabled public registration, where an attacker must first compromise or obtain any low-privilege credential, and (b) sites where the plugin is deactivated or removed. |
| Impact | The NVD/Patchstack CVSS 3.1 vector is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but this conflicts with the advisory title 'Subscriber Privilege Escalation,' which by definition requires an authenticated Subscriber account - that would normally drive PR:L and a base score nearer 8.8. The PR:N rating is plausible only if the WordPress site permits open user registration (the default on many e-commerce installations), effectively making any visitor able to obtain Subscriber credentials. There is no EPSS score, no KEV listing, and no public PoC referenced in the input, so real-world exploitation pressure is currently unquantified; however, WordPress privilege-escalation flaws of this class are historically attractive to mass-scanning campaigns once a PoC drops. Treat this as a high-priority patch for any site running the plugin with open registration enabled, and a moderate priority where registration is closed. |
| Exploit ScenarioDerived | An attacker registers a Subscriber account on a target WordPress site (or uses an existing one), then issues a crafted request to a vulnerable plugin endpoint that fails to verify capabilities, elevating their role to Administrator. From there the attacker installs a malicious plugin or theme to obtain code execution on the server, enabling full site takeover and pivot into WooCommerce order/PII data. No public PoC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4 and earlier allows low-privileged users - specifically Subscriber-level accounts - to elevate their permissions on the WordPress site. Patchstack catalogued this as an authorization/authentication-bypass class issue (CWE-863). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Upgrade the SMS Alert Order Notifications plugin to any version released after 3.9.4 once the vendor publishes a fix; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-4-privilege-escalation-vulnerability) is the authoritative source for the patched version and should be monitored. Until a patched release is independently confirmed, the most effective compensating control is to deactivate the plugin entirely on production sites, which will stop SMS order notifications but eliminates the attack surface; if that is not acceptable, disable open user registration in WordPress (Settings → General → 'Anyone can register' off) to remove the unauthenticated path, and use a virtual-patching WAF such as Patchstack or Wordfence to block the vulnerable plugin endpoints (which will degrade gracefully if the WAF signature is imprecise). Additionally, audit existing low-privilege accounts and recently elevated administrators for signs of misuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin (CPE: cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications) that integrates SMS notifications with WooCommerce-style order events. The root cause class is CWE-863 (Incorrect Authorization), meaning the plugin exposes one or more administrative actions over the WordPress AJAX/REST surface without verifying that the requesting user holds the required capability. In WordPress plugins, this typically manifests as missing current_user_can() checks or reliance on nonces alone, allowing any logged-in user (including the default Subscriber role created by open registration) to invoke privileged handlers.
Know when Sms Alert Order Notifications gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Subscriber role is required to reach the vulnerable endpoint, so PR:L (not PR:N); network-reachable HTTP, no user interaction, and full admin takeover yields C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
Executive ViewAI
The SMS Alert Order Notifications WordPress plugin (versions ≤3.9.4) contains a critical authorization bypass (CVSS 9.8) that enables any Subscriber-level user to escalate privileges to full administrative control. Although no public exploit has been identified at time of analysis, the vulnerability's severity and accessibility to low-privileged users create immediate organizational risk for any WordPress installation running this plugin. Organizations must assume exploitation will become prevalent once the plugin weakness gains wider awareness.
Remove or disable SMS Alert Order Notifications plugin immediately on all affected installations. Minimize creation of Subscriber-level accounts to essential personnel only. Implement WordPress user role auditing and logging to detect unauthorized escalations. Monitor and alert on all WordPress administrative account creation and role assignment changes. Implement administrative access restrictions and session monitoring for WordPress admin panel. Conduct quarterly audits of WordPress user roles and assigned capabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerabilit
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to privilege escalation via account t
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and ear
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allo
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets re
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision Techno
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insuff
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated s
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network
Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenti
SQL injection in the Cozy Vision 'SMS Alert Order Notifications - WooCommerce' WordPress plugin (all versions up to and
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th
GitHub PoC
Exploit-DB