What is the CVSS score of CVE-2026-66424?

CVE-2026-66424 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SMS Alert are affected by CVE-2026-66424?

The WooCommerce SMS Alert Order Notifications plugin (versions 3.9.7 and earlier) contains a critical privilege escalation vulnerability (CVE-2026-66424, CVSS 9.8) that allows unauthenticated…

How to fix or mitigate CVE-2026-66424?

Within 24 hours: Inventory all WordPress installations for the SMS Alert Order Notifications plugin across your domain, document affected instances with their current versions, and immediately disable the plugin on all sites via WordPress admin or server access. Within 7 days: Remove the plugin completely, restore database backups if unauthorized administrative changes are suspected, and execute comprehensive log analysis covering the prior 30 days to identify suspicious admin account creation, role escalations, or configuration modifications. Within 30 days: Deploy an alternative SMS notification solution that meets your business requirements, verify all WordPress user accounts and permissions are legitimate, and conduct a security audit of affected instances to confirm no persistent backdoors or rogue admin accounts remain.

SMS Alert CVE-2026-66424

EUVD-2026-57860 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-08-13 Patchstack

GHSA-775p-2663-95h5

WordPress Privilege Escalation Sms Alert Order Notifications Wordpress Plugin Cozy Vision Technologies Pvt Ltd

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-reachable privilege escalation with no user interaction (PR:N/UI:N/AC:L) leading to administrative takeover, giving full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:42 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

AnalysisAI

Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.

Technical ContextAI

The affected component is the Cozy Vision Technologies "SMS Alert Order Notifications" plugin for WordPress/WooCommerce, identified by CPE cpe:2.3:a:cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications:*:*:*:*:*:*:*:*, which sends SMS notifications for store order events. The root cause class is CWE-266 (Incorrect Privilege Assignment): a code path assigns or grants a privilege level higher than a caller should hold, typically because a WordPress endpoint (AJAX action, REST route, or admin handler) lacks a proper capability or authentication check, or applies the wrong role/capability mapping. In WordPress plugins this pattern commonly manifests as a nopriv-accessible handler that can modify user roles, create administrator accounts, or alter option values that control access, allowing an unauthenticated request to escalate to administrative control.

RemediationAI

Update the SMS Alert Order Notifications plugin to a version later than 3.9.7 as soon as the vendor releases a fixed build; no vendor-released patch version is independently confirmed from the provided data, so verify the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-7-privilege-escalation-vulnerability?_s_id=cve) and the plugin's WordPress.org listing before deploying. Until a patched version is applied, the safest compensating control is to deactivate and remove the plugin, which stops order-SMS notifications but eliminates the exposed code path; if the plugin must remain active, place the site behind a WordPress-aware WAF (such as Patchstack or equivalent) with a virtual patch for this CVE, and restrict access to wp-admin and the plugin's AJAX/REST endpoints (for example blocking or authenticating the admin-ajax.php actions and REST routes the plugin registers) via network ACLs, accepting that overly broad blocking may break legitimate store or notification functionality. After patching, audit user accounts for unexpected administrator additions or role changes that could indicate prior exploitation.