Cozy Vision Technologies Pvt Ltd
Monthly
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets remote attackers obtain elevated privileges without authentication or user interaction, with high confidentiality, integrity, and availability impact (CVSS 9.8). The issue is classified as CWE-266 incorrect privilege assignment and was reported by Patchstack; the vulnerable endpoint or feature that triggers the escalation is not described in the available sources. The vuln.today priority is act_now, no public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network attackers to obtain elevated privileges on affected sites, with the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1 High) indicating no authentication or user interaction but high attack complexity. The underlying issue is CWE-266 incorrect privilege assignment, and successful exploitation depends on a condition outside the attacker's control such as a race condition, predictable value, or specific plugin/site state; the exact trigger was not disclosed in the provided data. No public exploit identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4 and earlier allows low-privileged users - specifically Subscriber-level accounts - to elevate their permissions on the WordPress site. Patchstack catalogued this as an authorization/authentication-bypass class issue (CWE-863). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenticated attackers to access functionality or data that should be restricted to authenticated users. The flaw, reported by Patchstack and tracked under CWE-862 (Missing Authorization), carries a CVSS 7.5 with high confidentiality impact only. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets remote attackers obtain elevated privileges without authentication or user interaction, with high confidentiality, integrity, and availability impact (CVSS 9.8). The issue is classified as CWE-266 incorrect privilege assignment and was reported by Patchstack; the vulnerable endpoint or feature that triggers the escalation is not described in the available sources. The vuln.today priority is act_now, no public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network attackers to obtain elevated privileges on affected sites, with the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1 High) indicating no authentication or user interaction but high attack complexity. The underlying issue is CWE-266 incorrect privilege assignment, and successful exploitation depends on a condition outside the attacker's control such as a race condition, predictable value, or specific plugin/site state; the exact trigger was not disclosed in the provided data. No public exploit identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Privilege escalation in the SMS Alert Order Notifications WordPress/WooCommerce plugin (versions 3.9.6 and earlier) allows unauthenticated attackers to gain elevated privileges, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Classified as CWE-266 (Incorrect Privilege Assignment) and reported by Patchstack, the flaw lets a remote actor with no credentials assume higher-privileged roles, potentially reaching administrative control of the site. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Privilege escalation in the WordPress plugin SMS Alert Order Notifications (by Cozy Vision Technologies) versions 3.9.4 and earlier allows low-privileged users - specifically Subscriber-level accounts - to elevate their permissions on the WordPress site. Patchstack catalogued this as an authorization/authentication-bypass class issue (CWE-863). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the WordPress plugin SMS Alert Order Notifications (versions <= 3.9.3) allows remote unauthenticated attackers to access functionality or data that should be restricted to authenticated users. The flaw, reported by Patchstack and tracked under CWE-862 (Missing Authorization), carries a CVSS 7.5 with high confidentiality impact only. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
The SMS Alert Order Notifications WordPress plugin (slug sms-alert) through version 4.0.1 performs insufficient authorization checks on at least one of its order-notification actions, allowing a logged-in low-privilege user to invoke functionality that should be reserved for shop managers or administrators. Because the CVSS vector carries PR:L, exploitation requires a valid authenticated WordPress account on a site where the plugin is active - there is no anonymous path - and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the 4.3 score reflects a genuinely moderate, not high-priority, exposure.