SMS Alert <= 3.9.5 Unauthenticated Privilege Escalation via Arbitrary Password Reset (CVE-2026-11387)

Vulnerability Overview Vulnerability Name: SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset CVE ID: CVE-2026-11387 CVSS Score: 9.8 (Critical) Publication Date: June 30, 2026 Last Update Date: July 1, 2026 Researcher: Chloe Chamberland - Wordfence PRISM Affected Versions Software Type: Plugin Software Name: SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Affected Versions: <= 3.9.5 Fixed Version: 3.9.6 Remediation Fix: Update to version 3.9.6 or later patched versions Additional Information Vulnerability Description: This vulnerability allows an unauthenticated attacker to escalate privileges via an arbitrary password reset feature, gaining full access to WordPress accounts. This vulnerability only applies to websites where OTP verification is enabled and administrators (or other users) have a phone number configured for OTP verification. Reference Links: - plugins.trac.wordpress.org Related Recent Vulnerabilities SMS Alert Order Notifications – WooCommerce <= 3.9.0 - Missing Authorization - CVE ID: CVE-2026-32373 - CVSS Score: 4.3 - Researcher: benzeus - Publication Date: February 18, 2026 SMS Alert Order Notifications – WooCommerce <= 3.8.8 - Missing Authorization - CVE ID: CVE-2025-66086 - CVSS Score: 5.3 - Researcher: benzeus - Publication Date: December 5, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.5 - Unauthenticated SQL Injection - CVE ID: CVE-2025-49915 - CVSS Score: 7.5 - Researcher: ChuongVN - Publication Date: August 15, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode - CVE ID: CVE-2025-3878 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Publication Date: May 9, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function - CVE ID: CVE-2025-3876 - CVSS Score: 8.8 - Researcher: wesley (wcraft) - Publication Date: May 9, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Unauthenticated SQL Injection - CVE ID: CVE-2025-47682 - CVSS Score: 7.5 - Researcher: astra riveri - Publication Date: May 8, 2025 SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation - CVE ID: CVE-2024-13553 - CVSS Score: 9.8 - Researcher: Lucio Sá - Publication Date: March 31, 2025 SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Unauthenticated SQL Injection - CVE ID: CVE-2025-26988 - CVSS Score: 7.5 - Researcher: Hakiduck - Publication Date: February 2, 2025 SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting - CVE ID: CVE-2025-26984 - CVSS Score: 6.1 - Researcher: Hakiduck - Publication Date: February 23, 2025 Summary This vulnerability is a critical security issue that allows unauthenticated attackers to escalate privileges through an arbitrary password reset mechanism. It is recommended to update to version 3.9.6 or later patched versions as soon as possible to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

SMS Alert <= 3.9.5 Unauthenticated Privilege Escalation via Arbitrary Password Reset (CVE-2026-11387)

More from this source