SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 — unauthenticated privilege escalation via arbitrary password reset A critical improper-authentication flaw in the WordPress plugin SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. When OTP verification is enabled for password...

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ Escalada de Privilegios no Autenticada mediante Restablecimiento de Contraseña Arbitraria ☆ === Beelze === 📋 Información de la Vulnerabilidad Campo| Detalles ---|--- CVE ID| CVE-2026-11387 CVSS Score| 9.8 Critical CVSS Vector|...

CVE-2026-62106

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106

SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9 ) is affected by a Subscriber-level privilege escalation vulnerability. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-privileged (Subscriber) user can achieve hi...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

EUVD-2026-76213

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

EUVD-2026-57860

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

PT-2026-71547

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-15206

CVE-2026-15206 affects the SMS Alert WordPress plugin (before 3.9.8). The vulnerability arises because the plugin does not bind the mobile verified session flag to the actually verified phone number. After an attacker verifies an OTP on their own number, the signup/login handler reads an attacker...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15671

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...