WordPress security changelog
CRITICAL CVE-2026-11387 Deferred

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Privilege escalation or authentication bypass

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.9.5.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Plugin slug
sms-alert
Affected
<= 3.9.5
Safe version
See mitigation notes
Published
Jul 01, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Jul 01, 2026 and is one of 18 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery when a release after 3.9.5 becomes available; until then, disable and remove it when the site's risk warrants. The official upstream changelog lists version 3.9.8, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources