CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
Explanation of Vulnerability in Simple Terms
The SMS Alert plugin for WooCommerce contains an authorization flaw that allows authenticated users with low privileges to perform actions they should not have access to. An attacker with a basic user account can read sensitive data, modify site content, or disrupt service. All versions up to 3.8.1 are affected. Update immediately to a patched version.
What an attacker can do
Read sensitive data, modify content, or disrupt the site using a low-privilege user account.
Potential impact on your site
Any registered user can access admin functions and compromise customer data, orders, or SMS notification settings.
Conditions required to exploit
Attacker needs a valid low-privilege user account on the WooCommerce site; no user interaction required.
Key dates
External resources
