SMS Alert EUVD-2026-57860

The only precondition is that a target WordPress site has the SMS Alert Order Notifications plugin (version 3.9.7 or earlier) installed and active and is reachable over the network; per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no special conditions - remote unauthenticated exploitation against default configurations of the SMS Alert plugin, with no authentication, no user interaction, and low attack complexity. The practical limiting factor is deployment footprint: only sites actually running this specific plugin are exposed, so the population is bounded by the plugin's install base rather than by any configuration or platform requirement. Exact affected sub-features are not detailed in the available data beyond the privilege-escalation classification.

The signals are largely aligned toward high priority: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N, meaning no authentication, low complexity, and no user interaction, while impact is High across C/I/A - the profile of a full site takeover. Countervailing context is that EPSS is not provided, the CVE is not in CISA KEV (so no confirmed active exploitation), and no public proof-of-concept is identified, so real-world exploitation is currently unproven rather than confirmed. Given that this is an unauthenticated privilege-escalation bug in an internet-facing WordPress plugin - the exact class attackers routinely mass-scan and weaponize once details circulate - even a mid-sized municipal IT team in gniezno running this plugin should treat patching as urgent rather than waiting for exploitation evidence. SSVC-style framing would rate technical impact as total and automatability as likely once a POC exists, though exploitation status remains "none observed" today, so the practical verdict is a genuine high-priority issue whose only mitigating factor is the current absence of a published exploit.

An attacker scans the internet for WooCommerce sites running SMS Alert Order Notifications 3.9.7 or earlier and sends a crafted unauthenticated HTTP request to the plugin's vulnerable endpoint. Because the endpoint fails to enforce proper capability checks (CWE-266), the request elevates the attacker's effective privileges - for example creating or promoting an administrator account - giving full control of the site with no login or user interaction required. No public POC is currently identified, so this reflects the vector implied by the CVSS metrics rather than an observed exploit.