What’s Vulnerable › Vulnerabilities

CVE-2026-1833: WaMate Confirm <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-862

Description

The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators.

Affected products

• sm_rasmy WaMate Confirm – Order Confirmation: through 2.0.1

References

• https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579
• https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596
• https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579
• https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve

Get alerted when CVE-2026-1833 or the next vulnerability affects your stack