SMS Alert Order Notifications

SMS Alert Order Notifications through 3.9.9 permits privilege escalation by an authenticated Subscriber. The CNA vector requires no user interaction and rates confidentiality, integrity, and availability impact as high. The authoritative export does not identify the endpoint, action, parameter, capability granted, or final privilege level.

SMS Alert through 3.9.7 uses shared OTP-verification session state across multiple supported form integrations. The official 3.9.8 source replaces the common sa_mobile_verified flag with integration-specific verification flags and tightens WooCommerce phone and session matching, preventing verification in one flow from satisfying another security boundary.

SMS Alert before 3.9.8 marks a session as mobile-verified after the attacker completes an OTP challenge for their own phone, but does not bind that flag to the verified number. The signup/login handler then accepts a fresh attacker-supplied phone number, selects the WordPress account associated with it and issues a session. An unauthenticated attacker who knows an Administrator's billing phone can therefore take over that account.

SMS Alert through 3.9.7 saves Administrator-controlled checkout_payment_plans and order_status settings through smsalert_Setting_Options::save() or saveSettings() and update_option(). When the cod_to_prepaid_cart_notification_sendsms_hook cron event later runs SA_CodTOPrepaid::sendSms(), those stored values are concatenated into a posts and postmeta SELECT query. An Administrator can therefore plant a second-order SQL-injection payload that executes asynchronously and can expose database data. Version 3.9.8 parameterizes the cron query with $wpdb->prepare().

SMS Alert through 3.9.7 exposes an SQL-injection path on its manage_options All Subscriber page. All_Subscriber_List::processBulkAction() reads selected ID request values for the sa_sub_sendsms bulk action and passes them as post_ids to template/sms_campaign.php; the template interpolates each value directly into a subscriber SELECT query. An Administrator can inject SQL and extract database data. SMS Alert 3.9.8 casts the identifier with absint() and parameterizes the queries. The CNA calls the parameter id; upstream code uses the selected ID request field.

SMS Alert through 3.9.7 reads the orderby request parameter on its manage_options All Subscriber page in All_Subscriber_List::getAllSubscriber(). It applies only text sanitization and appends the value directly to the SQL ORDER BY clause before $wpdb->get_results(), enabling an Administrator to perform time-based SQL injection and extract database information. Version 3.9.8 restricts the sort column and direction to allow-lists and parameterizes pagination values.

SMS Alert through 3.9.7 can authenticate an unauthenticated caller as an existing WordPress user when the signup-with-mobile flow is enabled. A caller first verifies an OTP for a phone number they control, then sends option=signwthmob with a different billing_phone value to processRegistration(). The vulnerable handler trusts the session's sa_mobile_verified flag and uses an insufficient substring comparison against sa_mobile before resolving the supplied phone number and passing the victim user ID to wp_set_auth_cookie(). A known or guessable administrator phone number therefore permits full site takeover.

SMS Alert Order Notifications is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.9.6.

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.9.5.

SMS Alert Order Notifications is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.9.4.

SMS Alert Order Notifications is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.9.3.

SMS Alert Order Notifications is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

SMS Alert Order Notifications is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

SMS Alert Order Notifications is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

SMS Alert Order Notifications – WooCommerce is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

SMS Alert Order Notifications – WooCommerce is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.

SMS Alert Order Notifications – WooCommerce is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.

SMS Alert Order Notifications – WooCommerce is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.