CVE-2026-62106
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.
Risk Assessment
A subscriber can gain unauthorized access to administrative functions, potentially leading to configuration changes, malware installation, or data theft. This is a serious security breach for a WordPress site.
Recommendation
Update the SMS Alert Order Notifications plugin to a version later than 3.9.9 as soon as a fix is available. Until patched, restrict subscriber registration and monitor for unusual privilege changes.
Other vulnerabilities in SMS Alert Order Notifications
See all- CVE-2026-54802High
Versions of SMS Alert Order Notifications up to 3.9.3 contain a vulnerability in authentication that allows unauthorized access.
- CVE-2026-66424Critical
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
- CVE-2026-59540Critical
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
- CVE-2026-54803Critical
Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.
Original NVD description (English source)
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.