CVE-2026-95594
HighCVSS 8.1Summary
A vulnerability in the SMS Alert Order Notifications plugin (versions up to 4.0.0) allows unauthenticated privilege escalation. This means an attacker without logging in can elevate their privileges in the system.
Risk Assessment
An unauthenticated attacker can gain higher privileges, potentially leading to admin account takeover or unauthorized actions.
Recommendation
Update the SMS Alert Order Notifications plugin to the latest version if a patch is available. Restrict access to the admin panel and monitor logs for unauthorized activities.
Other vulnerabilities in SMS Alert Order Notifications
See all- CVE-2026-54802High
Versions of SMS Alert Order Notifications up to 3.9.3 contain a vulnerability in authentication that allows unauthorized access.
- CVE-2026-66424Critical
Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.
- CVE-2026-59540Critical
The SMS Alert Order Notifications plugin versions up to 3.9.6 contain an unauthenticated privilege escalation vulnerability.
- CVE-2026-54803Critical
Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.
- CVE-2026-62106High
The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.
Original NVD description (English source)
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS