What is the CVSS score of EUVD-2026-37639?

EUVD-2026-37639 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-37639?

Within 24 hours: audit all WordPress installations for SMS Alert Order Notifications plugin versions 3.9.4 and earlier; immediately disable or remove the plugin from all affected sites; review WordPress security audit logs for evidence of unauthorized privilege escalations by Subscriber-level accounts. Within 7 days: reset all WordPress administrator account credentials; audit Subscriber-level user activities and account modifications from the past 60 days; implement WordPress user capability restrictions limiting what Subscriber-role users can perform. Within 30 days: deploy alternative order notification solutions not dependent on this plugin; monitor Cozy Vision Technologies vendor advisories for a patched version; establish continuous monitoring for WordPress administrative account creation anomalies.

SMS Alert Order Notifications EUVD-2026-37639

| CVE-2026-54803 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-17 Patchstack

WordPress Authentication Bypass Privilege Escalation Sms Alert Order Notifications Wordpress Plugin Cozy Vision Technologies Pvt Ltd

9.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Register Subscriber account via open signup
Delivery

Authenticate to WordPress
Exploit

Send crafted request to vulnerable plugin endpoint
Install

Bypass capability check (CWE-863)
C2

Escalate role to Administrator
Execute

Upload malicious plugin for RCE
Impact

Full site and order-data takeover

Vulnerability Assessment

Weakness	CWE CWE-863 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization logic validation MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The SMS Alert Order Notifications plugin (≤ 3.9.4) must be installed and activated on a WordPress site, and the attacker must be able to authenticate as a Subscriber-level user - which on sites with open user registration enabled (a common default for WooCommerce stores) is effectively unauthenticated, because anyone can self-register a Subscriber account. Exploitation is over HTTP/HTTPS with no user interaction and no admin involvement; what limits it is (a) sites that have disabled public registration, where an attacker must first compromise or obtain any low-privilege credential, and (b) sites where the plugin is deactivated or removed.
Impact	The NVD/Patchstack CVSS 3.1 vector is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but this conflicts with the advisory title 'Subscriber Privilege Escalation,' which by definition requires an authenticated Subscriber account - that would normally drive PR:L and a base score nearer 8.8. The PR:N rating is plausible only if the WordPress site permits open user registration (the default on many e-commerce installations), effectively making any visitor able to obtain Subscriber credentials. There is no EPSS score, no KEV listing, and no public PoC referenced in the input, so real-world exploitation pressure is currently unquantified; however, WordPress privilege-escalation flaws of this class are historically attractive to mass-scanning campaigns once a PoC drops. Treat this as a high-priority patch for any site running the plugin with open registration enabled, and a moderate priority where registration is closed.
Exploit ScenarioDerived	An attacker registers a Subscriber account on a target WordPress site (or uses an existing one), then issues a crafted request to a vulnerable plugin endpoint that fails to verify capabilities, elevating their role to Administrator. From there the attacker installs a malicious plugin or theme to obtain code execution on the server, enabling full site takeover and pivot into WooCommerce order/PII data. No public PoC has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4 and earlier allows low-privileged users - specifically Subscriber-level accounts - to elevate their permissions on the WordPress site. Patchstack catalogued this as an authorization/authentication-bypass class issue (CWE-863). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Upgrade the SMS Alert Order Notifications plugin to any version released after 3.9.4 once the vendor publishes a fix; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-4-privilege-escalation-vulnerability) is the authoritative source for the patched version and should be monitored. Until a patched release is independently confirmed, the most effective compensating control is to deactivate the plugin entirely on production sites, which will stop SMS order notifications but eliminates the attack surface; if that is not acceptable, disable open user registration in WordPress (Settings → General → 'Anyone can register' off) to remove the unauthenticated path, and use a virtual-patching WAF such as Patchstack or Wordfence to block the vulnerable plugin endpoints (which will degrade gracefully if the WAF signature is imprecise). Additionally, audit existing low-privilege accounts and recently elevated administrators for signs of misuse.

Affected VersionsENISA

SMS Alert Order Notifications n/a ≤3.9.4

Affected Packages

euvd sms_alert_order_notifications no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is a WordPress plugin (CPE: cozy_vision_technologies_pvt._ltd.:sms_alert_order_notifications) that integrates SMS notifications with WooCommerce-style order events. The root cause class is CWE-863 (Incorrect Authorization), meaning the plugin exposes one or more administrative actions over the WordPress AJAX/REST surface without verifying that the requesting user holds the required capability. In WordPress plugins, this typically manifests as missing current_user_can() checks or reliance on nonces alone, allowing any logged-in user (including the default Subscriber role created by open registration) to invoke privileged handlers.

Know when Sms Alert Order Notifications gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Subscriber role is required to reach the vulnerable endpoint, so PR:L (not PR:N); network-reachable HTTP, no user interaction, and full admin takeover yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

Executive ViewAI

Why It Matters

The SMS Alert Order Notifications WordPress plugin (versions ≤3.9.4) contains a critical authorization bypass (CVSS 9.8) that enables any Subscriber-level user to escalate privileges to full administrative control. Although no public exploit has been identified at time of analysis, the vulnerability's severity and accessibility to low-privileged users create immediate organizational risk for any WordPress installation running this plugin. Organizations must assume exploitation will become prevalent once the plugin weakness gains wider awareness.

Business Impact: Severe

Compensating Controls

Remove or disable SMS Alert Order Notifications plugin immediately on all affected installations. Minimize creation of Subscriber-level accounts to essential personnel only. Implement WordPress user role auditing and logging to detect unauthorized escalations. Monitor and alert on all WordPress administrative account creation and role assignment changes. Implement administrative access restrictions and session monitoring for WordPress admin panel. Conduct quarterly audits of WordPress user roles and assigned capabilities.

Threat Intelligence Overview

EPSS Score

0.4%

Top 64% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.