SMS Alert Order Notifications EUVD-2026-76213

Exploitation requires the attacker to possess a valid subscriber-level WordPress account on the target site, meaning either open user registration is enabled, or the attacker has obtained credentials through a separate means (phishing, credential stuffing). The SMS Alert Order Notifications plugin must be installed and active in a version ≤ 3.9.9. No special plugin configuration beyond a default installation is implied by the description. Exploitation is concretely limited by the subscriber-account prerequisite (PR:L): sites that disable public user registration and restrict account creation to administrators significantly reduce external exposure, as an attacker must first acquire valid credentials before this flaw can be triggered.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is a credible scoring for this class of vulnerability: network-reachable from any internet-connected browser, low complexity requiring no race conditions or special configuration, and demanding only a subscriber-level account with no user interaction. The full C:H/I:H/A:H triad reflects the realistic post-exploitation outcome of full WordPress administrative access. EPSS data was not present in the supplied intelligence, and neither a KEV listing nor confirmed public exploit code is available, so the immediate opportunistic exploitation likelihood is uncertain rather than elevated. That said, even a mid-sized municipal IT team in zabrze running WooCommerce with open subscriber registration should treat this as urgent, because privilege-escalation flaws in WordPress plugins are routinely swept up by automated exploit kits within days of Patchstack disclosure. The absence of a confirmed patched version in the supplied data is a meaningful gap - defenders should not assume a fix is available without verifying directly.

An attacker registers a free subscriber account on a target WooCommerce site running the SMS Alert Order Notifications plugin. After authenticating, they submit a crafted HTTP request - likely to an unguarded AJAX action or REST endpoint - that exploits the plugin's missing capability check to assign themselves an administrator role. With administrator access gained, the attacker can install arbitrary plugins or edit theme files to achieve remote code execution on the server.