Cozyvision1
Monthly
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Account-takeover privilege escalation in the SMS Alert - SMS & OTP for WooCommerce WordPress plugin (versions up to and including 3.9.5) lets unauthenticated remote attackers change any user's email address and trigger a password reset, seizing administrator accounts. The flaw stems from the OTP-based password-reset flow failing to verify the requester's identity before updating account details. No public exploit has been identified at time of analysis, though the issue was disclosed by Wordfence and carries a 9.8 CVSS rating.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenticated attackers to log in as any existing user whose phone number is known or guessable, including administrators. The flaw stems from the `processRegistration()` function using an unbound session flag after any OTP verification, enabling attackers to first verify their own phone number and then swap in a victim's `billing_phone` to obtain an authentication cookie. No public exploit code was identified at the time of analysis.
Account-takeover privilege escalation in the SMS Alert - SMS & OTP for WooCommerce WordPress plugin (versions up to and including 3.9.5) lets unauthenticated remote attackers change any user's email address and trigger a password reset, seizing administrator accounts. The flaw stems from the OTP-based password-reset flow failing to verify the requester's identity before updating account details. No public exploit has been identified at time of analysis, though the issue was disclosed by Wordfence and carries a 9.8 CVSS rating.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.