What’s Vulnerable › Vulnerabilities
CVE-2026-116386: WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-30 · updated 2026-10-30
- Weakness: CWE-266
Description
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
Summary
CVE-2026-116386 is a critical unauthenticated privilege escalation flaw in the WordPress plugin SMS Alert Order Notifications, affecting versions up to and including 4.0.2 (CVSS 9.8). Because no authentication is required, an attacker could exploit it to gain elevated privileges on vulnerable WordPress sites. It is not listed in CISA KEV and no exploitation has been reported. Update the plugin to version 4.0.3 or later to remediate.
CVE-2026-116386 هو ثغرة حرجة لتصعيد الصلاحيات دون مصادقة في إضافة WordPress المسماة SMS Alert Order Notifications، وتؤثر في الإصدارات حتى 4.0.2 (بدرجة CVSS 9.8). ولأن الثغرة لا تتطلب مصادقة، فقد يستغلها المهاجم للحصول على صلاحيات مرتفعة على مواقع WordPress المتأثرة. الثغرة غير مدرجة في CISA KEV ولم يُبلَّغ عن أي استغلال فعلي لها. يجب تحديث الإضافة إلى الإصدار 4.0.3 أو أحدث لمعالجة المشكلة.
Affected products
- Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications: through 4.0.2 — fixed in 4.0.3
How to fix
Upgrade to a fixed version: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications 4.0.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-116386 or the next vulnerability affects your stack