SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 — 未认证的通过任意密码重置实现的权限提升 WordPress 插件 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery 中存在一个严重的身份验证不当漏洞。当为密码重置启用 OTP 验证时，未认证的调用者可以为档案中留有电话号码的用户（包括管理员）设置新密码，而无需证明其拥有该电话号码。 | ---|--- CVE| CVE-2026-11387 CWE| CWE-287: 身份验证不当 CVSS 3.1|...

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ 未認証の権限昇格（任意のパスワードリセット経由） ☆ === Beelze === 📋 脆弱性情報 項目| 詳細 ---|--- CVE ID| CVE-2026-11387 CVSSスコア| 9.8 Critical CVSSベクトル| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H タイプ| 認証欠如 / OTPバイパス プラグイン| SMS Alert – WooCommerce向けOTP認証 sms-alert 影響を受けるバージョン| ≤ 3.9.5 修正バージョ...

CVE-2026-62106

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106

SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9 ) is affected by a Subscriber-level privilege escalation vulnerability. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-privileged (Subscriber) user can achieve hi...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

EUVD-2026-76213

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

EUVD-2026-57860

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

PT-2026-71547

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-15206

CVE-2026-15206 affects the SMS Alert WordPress plugin (before 3.9.8). The vulnerability arises because the plugin does not bind the mobile verified session flag to the actually verified phone number. After an attacker verifies an OTP on their own number, the signup/login handler reads an attacker...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15671

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...