WordPress security changelog
CRITICAL CVE-2026-11387 Deferred

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Privilege escalation or authentication bypass

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 3.9.5.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Plugin slug
sms-alert
Affected
<= 3.9.5
Safe version
> 3.9.5
Published
Jul 01, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Jul 01, 2026 and is one of 11 known issues for this plugin.

What to do

Patch or disable the affected component.

Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to a release after 3.9.5, or disable and remove it until a fixed version is available.

Source record

Technical description

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources