EUVD-2026-37638Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with SMS Alert plugin
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitBypass missing authorization check
-
ExecutionInvoke privileged plugin endpoint
-
ImpactExfiltrate restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be running WordPress with the SMS Alert Order Notifications plugin (by Cozy Vision Technologies) installed and active at version 3.9.3 or earlier, and the vulnerable plugin endpoint must be reachable over the network (typical default for any internet-facing WordPress install). No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Limiting factor: sites that have deactivated the plugin, are behind authentication-enforcing WAF rules, or are only reachable from internal networks are not exposed. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a network-reachable, low-complexity, unauthenticated, no-user-interaction issue with high confidentiality impact and no integrity or availability impact, consistent with information disclosure via a broken authorization check rather than full account takeover or RCE. The vulnerability is not listed in CISA KEV and no public POC has been identified at time of analysis, so there is no evidence of active exploitation; however, WordPress plugin authorization bugs are routinely weaponized by mass-scanning botnets once Patchstack details are public, so the practical risk to exposed WooCommerce sites is meaningful. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One conflict to note: the CVSS describes only confidentiality impact, while the 'Broken Authentication' label and CWE-862 could in principle enable broader abuse - the precise endpoint behavior should be verified from the Patchstack advisory before scoping impact. |
| Exploit ScenarioDerived | An attacker discovers a WordPress/WooCommerce site running SMS Alert Order Notifications <= 3.9.3, then issues unauthenticated HTTP requests directly to the plugin's vulnerable AJAX or REST endpoint to retrieve data or trigger functionality that should require an authenticated administrator session. Because the flaw is network-reachable, low-complexity, and requires no user interaction, the request can be sent by an automated scanner against any reachable site at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenticated attackers to access functionality or data that should be restricted to authenticated users. The flaw, reported by Patchstack and tracked under CWE-862 (Missing Authorization), carries a CVSS 7.5 with high confidentiality impact only. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade SMS Alert Order Notifications to the latest release published after 3.9.3 by Cozy Vision Technologies once available on the WordPress plugin repository, consulting the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-3-broken-authentication-vulnerability for the fixed version. Until the plugin can be upgraded, deactivate and remove the SMS Alert Order Notifications plugin (which will disable order SMS notifications), or place the affected endpoints behind a WAF rule that blocks unauthenticated requests to the plugin's AJAX/REST routes (trade-off: may break any legitimate front-end integrations that the plugin exposes). Restricting access to /wp-admin/admin-ajax.php and /wp-json/ paths via IP allowlisting on staging sites, and ensuring the plugin is not active on internet-exposed environments, are additional compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is SMS Alert Order Notifications, a WordPress plugin by Cozy Vision Technologies Pvt. Ltd. used by WooCommerce/WordPress site operators to send SMS notifications for order events. The CPE cpe:2.3:a:cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications confirms the vendor and product. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - typically AJAX actions or REST routes registered by the plugin - fail to enforce a capability check or nonce validation before performing a privileged operation or returning sensitive data, allowing requests from unauthenticated sources to be processed as if authorized.
Know when Sms Alert Order Notifications gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Plugin endpoint is reachable over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); broken authorization exposes restricted data only, so C:H with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.
Executive ViewAI
The SMS Alert Order Notifications WordPress plugin (versions 3.9.3 and earlier) contains an authentication bypass vulnerability (CVE-2026-54802) that allows unauthenticated attackers to access order notification data and restricted functionality. Organizations running this plugin face direct exposure of customer order information and transactional data without requiring legitimate credentials. This creates compliance violations under PCI-DSS and GDPR, plus reputational risk if customer data is exfiltrated.
Until vendor patch available: (1) Disable SMS Alert Order Notifications plugin entirely; (2) Implement network-level restrictions on plugin files using Web Application Firewall (WAF) rules blocking unauthenticated requests to plugin endpoints; (3) Enforce WordPress authentication checks at reverse proxy/load balancer for order-related routes; (4) Enable enhanced logging on order/notification data access; (5) Segment e-commerce database access to authorized systems only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerabilit
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to privilege escalation via account t
Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and ear
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allo
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets re
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision Techno
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insuff
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated s
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network
SQL injection in the Cozy Vision 'SMS Alert Order Notifications - WooCommerce' WordPress plugin (all versions up to and
The SMS Alert Order Notifications - WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th
GitHub PoC
Exploit-DB