Critical Unauthenticated Privilege Escalation in SMS Alert Plugin

WordPress

What happened

There is a privilege escalation vulnerability in versions of the SMS Alert Order Notifications plugin up to 4.0.2. This can potentially allow unauthorized access to user privileges.

Are you affected?

The SMS Alert Order Notifications plugin may be affected if you are using version 4.0.2 or earlier.

What to do now

1. Upgrade the SMS Alert Order Notifications plugin to a version that is not affected.
2. Check the official advisory for more details and to ensure you have the latest updates.

Sources

• cve.now/CVE-2026-116386
• cve.now/GHSA-33r3-mmgj-jpmc
• CVE-2026-116386
• GHSA-33r3-mmgj-jpmc
• https://nvd.nist.gov/vuln/detail/CVE-2026-116386
• https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-4-0-2-privilege-escalation-vulnerability?_s_id=cve

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.