SMS Alert Order Notifications CVE-2026-59540

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation against default configurations of the SMS Alert Order Notifications plugin, requiring no authentication and no user interaction. The practical limiting factor is that the target WordPress site must have the SMS Alert Order Notifications plugin (version <= 3.9.6) installed and active; because it is a WooCommerce companion plugin, WooCommerce is typically also present. The exact vulnerable feature/endpoint is not detailed beyond the CWE-266 incorrect-privilege-assignment root cause, so the specific request path should be confirmed against the vendor/Patchstack advisory before assessing any narrower prerequisite.

The signals are only partially populated. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes fully remote, unauthenticated, low-complexity exploitation with total impact - the worst-case profile for a web plugin. However, no EPSS probability, no SSVC decision data, and no KEV status were provided, so exploitation likelihood cannot be quantified from the input and there is no public exploit identified at time of analysis. The 9.8 score reflects theoretical severity; whether it is a widespread active target depends on install base and exploit publication, neither of which is confirmed here. Note a minor tension: the C:H/I:H/A:H impact set is a maximal rating for a privilege-escalation flaw (CWE-266) whose primary effect is integrity/authorization compromise - the availability and confidentiality highs are plausible consequences of gaining admin but are inferred, not detailed in the description. Treat as a high-priority patch item for any site running this plugin, but verify exploitation prerequisites against the vendor advisory.

An unauthenticated attacker sends a crafted HTTP request to the plugin's vulnerable privilege-handling endpoint on a WooCommerce store running SMS Alert Order Notifications 3.9.6 or earlier, causing the plugin to assign the attacker (or a controlled account) an elevated role such as administrator. With administrative access obtained through this low-complexity, no-interaction request, the attacker can install malicious plugins, exfiltrate customer data, or fully take over the site. No public exploit is identified at time of analysis, so the exact request format is not independently confirmed.