9.8Critical

CVE-2026-116386WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability

Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications Published: 2026-10-30 21:30 (3 days ago)

Description

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

Weakness (CWE): CWE-266

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Cozy Vision Technologies Pvt. Ltd.	SMS Alert Order Notifications	≤ 4.0.2

References and patches

https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notificati… vdb-entry

CVSS score

9.8Critical

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	9.8Critical
audit@patchstack.com	CVSS 3.1	9.8Critical

EPSS (chance of exploitation in 30 days)

0.35%

higher than 29% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: total

Timeline

ID reserved2026-10-26
Published2026-10-30 21:30
Reached IP-DB2026-10-30 22:03
Last updated2026-10-30 22:22

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

4.3Medium

CVE-2026-103077 22 minutes ago

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

myCred myCred

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

6.5Medium

CVE-2026-114185 23 minutes ago

WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

WPVibes AnyWhere Elementor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

5.3Medium

CVE-2026-119485 25 minutes ago

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

weDevs Dokan

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

4.3Medium

CVE-2026-39777 27 minutes ago

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

WC Lovers WCFM Membership

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

5.3Medium

CVE-2026-119487 29 minutes ago

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

weDevs Dokan

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

6.5Medium

CVE-2026-120843 31 minutes ago

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Barn2 Plugins Posts Table with Search & Sort

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.