WordPress security changelog
CRITICAL
CVE-2026-54803
Deferred
SMS Alert Order Notifications: Privilege escalation or authentication bypass
SMS Alert Order Notifications is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.9.4.
CVE / CNA score
9.8
CVSS 3.1 · audit@patchstack.com
NVD score
Pending
NVD has not published its own CVSS assessment.
- Component
- SMS Alert Order Notifications
- Plugin slug
sms-alert- Affected
- n/a through 3.9.4
- Safe version
3.9.5- Published
- Jun 17, 2026
This CVE was published Jun 17, 2026 and is one of 11 known issues for this plugin.
What to do
Patch or disable the affected component.
Update SMS Alert Order Notifications to 3.9.5 or later, or disable and remove it until a fixed version is available.
Source record
Technical description
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References