SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 — 認証なしの任意パスワードリセットによる権限昇格 WordPressプラグイン SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery における重大な認証不備の脆弱性。パスワードリセット時にOTP検証が有効な場合、認証されていない呼び出し元が、電話番号が登録されているユーザー（管理者を含む）に対して、その電話の所有を証明することなく新しいパスワードを設定できます。 | ---|--- CVE|...

CVE-2026-11387

CVE-2026-11387 — SMS Alert ≤ 3.9.5 ☆ 未認証の権限昇格（任意のパスワードリセット経由） ☆ === Beelze === 📋 脆弱性情報 項目| 詳細 ---|--- CVE ID| CVE-2026-11387 CVSSスコア| 9.8 Critical CVSSベクトル| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H タイプ| 認証欠如 / OTPバイパス プラグイン| SMS Alert – WooCommerce向けOTP認証 sms-alert 影響を受けるバージョン| ≤ 3.9.5 修正バージョ...

CVE-2026-62106

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106

SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9 ) is affected by a Subscriber-level privilege escalation vulnerability. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-privileged (Subscriber) user can achieve hi...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

EUVD-2026-76213

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by benzdeus in WordPress Plugin SMS Alert Order Notifications versions = 3.9.9...

PT-2026-90022

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106: Incorrect Privilege Assignment

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

WordPress SMS Alert plugin < 3.9.8 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Sai Praneeth Koti in WordPress Plugin SMS Alert Order Notifications versions 3.9.8...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions

EUVD-2026-57860

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

PT-2026-71547

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...