SMS Alert CVE-2026-95594

The affected component is the SMS Alert Order Notifications WordPress plugin (vendor Cozy Vision Technologies) at versions <= 4.0.0, typically installed on WooCommerce stores. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are required, so any network-reachable instance is a candidate. The primary limiting factor is the high attack complexity (AC:H): exploitation depends on a condition the attacker does not fully control - plausibly a race condition, a correctly-guessed or predictable value, or a specific plugin/site state - which reduces reliability and the odds of opportunistic mass exploitation. The exact feature, endpoint, or configuration that triggers the incorrect privilege assignment was not disclosed in the provided data and should be confirmed against the Patchstack advisory.

The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) describes a network-reachable, unauthenticated flaw (PR:N) with no user interaction but with high attack complexity (AC:H), indicating that successful exploitation depends on conditions outside the attacker's direct control (e.g. timing, a specific state, or a predictable secret/parameter) rather than being a trivially repeatable request. CWE-266 (Incorrect Privilege Assignment) plus the 'privilege escalation' title means a successful exploit yields elevated WordPress privileges, consistent with the full C:H/I:H/A:H impact. No EPSS score, no CISA KEV listing, and no POC indicator were supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'; there is no signal of active or widespread exploitation. The combination of unauthenticated access with AC:H is the key tension here: the PR:N/AV:N profile makes it attractive and internet-reachable, but AC:H realistically dampens mass, reliable exploitation - this reads as a genuine patch-soon issue rather than a drop-everything emergency, and its real priority scales with how exposed the affected WooCommerce/WordPress sites are. No SSVC fields were provided, so automatable/technical-impact framing cannot be independently applied.

An unauthenticated attacker reaches a WordPress/WooCommerce site running SMS Alert Order Notifications 4.0.0 or earlier over the network and sends crafted requests that abuse the plugin's incorrect privilege assignment to grant themselves or manipulate an account into an elevated role. Because the CVSS vector marks high attack complexity, the attacker likely must win a race condition or satisfy a specific state/parameter rather than fire a single deterministic request. No public proof-of-concept was identified in the provided data.