SMS Alert Order Notifications – WooCommerce: Privilege escalation or authentication bypass

SMS Alert Order Notifications – WooCommerce is affected by privilege escalation or authentication bypass. Exploitation requires at least subscriber-level access. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: SMS Alert Order Notifications – WooCommerce
Plugin slug: sms-alert
Affected: See vendor advisory
Safe version: See mitigation notes
Published: Jan 07, 2025
Weakness: CWE-862 — Missing Authorization

This CVE was published Jan 07, 2025 and is one of 11 known issues for this plugin.

What to do

Patch or disable the affected component.

Update SMS Alert Order Notifications – WooCommerce to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources