CVE-2025-3876: fallo de gravedad alta en cozyvision1 SMS Alert – SMS & OTP for…
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.5%
probabilidad de explotación
0.5%top 62% de las CVE
explotación observada
noninguna fuente lo reporta
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cozyvision1 · SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart RecoveryCVEs relacionadas — cozyvision1 SMS Alert – SMS & OTP for…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-11387CRITICALSMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password ResetEPSS 2.2%CVE-2026-15014CRITICALSMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' ParameterEPSS 0.9%CVE-2024-13553CRITICALSMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege EscalationEPSS 0.5%CVE-2024-11725HIGHSMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%CVE-2026-15673MEDIUMSMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' SettingsEPSS 0.5%CVE-2026-15671MEDIUMSMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' ParameterEPSS 0.5%
Referencias
https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447https://plugins.trac.wordpress.org/changeset/3290478/https://wordpress.org/plugins/sms-alert/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve