CVE-2025-66086
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Cozy Vision SMS Alert Order Notifications WordPress plugin in versions up to and including 3.8.8 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An unauthorized user may perform actions gated by access control, potentially leading to unauthorized changes on the site. The risk affects WordPress sites with the vulnerable plugin installed.
Recommendation
Update the SMS Alert Order Notifications plugin to a version later than 3.8.8. Review and correct the plugin's permission configuration.
Other vulnerabilities in SMS Alert Order Notifications
See all- CVE-2026-116386Critical
The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-66424Critical
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
- CVE-2026-59540Critical
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
- CVE-2026-54803Critical
Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.
- CVE-2026-110882Medium
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.
- CVE-2026-95594High
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation. This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
- CVE-2026-62106High
The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.
- CVE-2026-54802High
Versions of SMS Alert Order Notifications up to 3.9.3 contain a vulnerability in authentication that allows unauthorized access.
Original NVD description (English source)
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS