What is the CVSS score of CVE-2026-59540?

CVE-2026-59540 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SMS Alert Order Notifications are affected by CVE-2026-59540?

The SMS Alert Order Notifications plugin for WooCommerce (versions 3.9.6 and earlier) contains a critical privilege escalation vulnerability enabling unauthenticated remote attackers to gain…

How to fix or mitigate CVE-2026-59540?

Within 24 hours, audit all WordPress installations for SMS Alert Order Notifications plugin versions 3.9.6 and earlier, documenting affected sites and their exposure level. Within 7 days, disable or remove the vulnerable plugin across all affected instances; this plugin is typically non-essential for core e-commerce operations. Within 30 days, contact the plugin developers through Patchstack to confirm an estimated patch timeline (expected version 3.9.7 or later), establish a testing plan for patch deployment, and monitor Patchstack advisories and the plugin repository for patch release notifications.

SMS Alert Order Notifications CVE-2026-59540

EUVD-2026-48193 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-07-23 Patchstack

GHSA-v59g-2c3c-298g

WordPress Privilege Escalation Sms Alert Order Notifications Wordpress Plugin Cozy Vision Technologies Pvt Ltd

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote privilege escalation via an exposed endpoint with no auth or interaction gives AV:N/AC:L/PR:N/UI:N; admin-level takeover justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:46 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

AnalysisAI

Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.

Technical ContextAI

The affected component is the SMS Alert Order Notifications plugin by Cozy Vision Technologies Pvt. Ltd., a WooCommerce add-on that sends SMS notifications for order and store events on WordPress sites (CPE: cpe:2.3:a:cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications). The root-cause class is CWE-266, Incorrect Privilege Assignment, meaning the plugin grants a level of access or role that does not match the actor's actual entitlements. In WordPress plugins this typically arises from an endpoint (AJAX action, REST route, or form handler) that performs a privileged operation - such as assigning or changing a user role/capability - without a proper capability check or nonce validation, so an unauthenticated request is treated as authorized to modify privilege state.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range is bounded at 3.9.6, so administrators should monitor the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-6-privilege-escalation-vulnerability) and upgrade to the first release above 3.9.6 as soon as it is confirmed available, cross-checking the WordPress.org plugin changelog for the exact patched version. Until a verified fix is applied, the strongest compensating control is to deactivate and remove the SMS Alert Order Notifications plugin, which stops SMS order notifications but eliminates the exposed endpoint entirely. If the plugin cannot be removed, place the site behind a WAF (such as Patchstack or equivalent) with a virtual patch for this CVE and restrict access to the plugin's AJAX/REST endpoints, monitor for unexpected new administrator accounts or role changes, and audit existing users for unauthorized privilege grants; the trade-off is that WAF rules are mitigations rather than a true fix and endpoint restrictions may interfere with legitimate SMS notification triggers.