Description

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-11T19:17:43.460Z",
  "pubdate": "2026-09-11T19:17:43.460Z",
  "executiveSummary": "The SMS Alert Order Notifications plugin for WordPress, in versions 3.9.9 and below, is susceptible to a privilege escalation vulnerability.\nThis vulnerability is classified as an Improper Authorization flaw, allowing authenticated users with low-level subscriber privileges to modify sensitive system settings or escalate their own account permissions.\nThe impact includes full administrative compromise of the affected WordPress installation, potentially leading to unauthorized data exfiltration, arbitrary code execution, or complete site takeover.\nThe vulnerability originates from a lack of sufficient capability checks within the plugin's administrative action handlers, allowing unauthorized users to invoke sensitive functions intended only for site administrators.\nExploitation requires the attacker to possess a registered subscriber-level account on the target WordPress installation.\nThe risk is considered high due to the potential for total loss of confidentiality, integrity, and availability of the web application.\nSuccessful exploitation allows attackers to perform unauthorized actions such as modifying plugin configurations, updating user roles, or manipulating notification delivery pathways.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the SMS Alert Order Notifications plugin, specifically in the mechanisms designed to process administrative requests for configuration updates or notification management.\nThe root cause of this vulnerability is the absence of robust nonce verification and appropriate capability checks (e.g., current_user_can('manage_options')) within the plugin's AJAX actions or admin-post handlers.\nWhen a user with subscriber privileges sends a crafted request to the vulnerable endpoint, the application fails to validate whether the requester possesses the required administrative permissions to perform the requested operation.\nThe attack flow begins when an attacker, authenticated as a subscriber, identifies the vulnerable endpoint responsible for administrative plugin settings. By injecting or intercepting a request, the attacker alters the parameters to target restricted functionality. Because the server-side code does not adequately verify the user's privilege level, the application processes the malicious request as if it were originated by an administrator.\nThis flaw effectively bypasses the WordPress access control model, allowing for horizontal or vertical privilege escalation. Depending on the specific implementation of the vulnerable handler, an attacker may be able to modify account roles or update the plugin's delivery settings to redirect SMS alerts containing sensitive order data to an attacker-controlled endpoint.\nFurthermore, if the plugin's architectural design allows for state-changing operations via simple GET or POST parameters without enforcing CSRF (Cross-Site Request Forgery) protection, an attacker can manipulate these values to influence the plugin's operational state. In some instances, this could lead to the modification of account details associated with high-privileged users or the injection of malicious notification templates.\nThe vulnerability affects all versions 3.9.9 and below. Post-exploitation, an attacker can leverage the escalated privileges to gain full administrative control, which may facilitate the installation of malicious themes or plugins, leading to remote code execution. The exposure is limited to authenticated network access, as the target endpoints are typically accessible to any registered user who can communicate with the backend request handlers."
}