SMS Alert Order Notifications <= 3.9.7 - Unauthenticated Privilege Escalation

The SMS Alert Order Notifications plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.9.7. This is due to a shared OTP session key (sa_mobile_verified) across all form handlers combined with an insufficient phone number check (strpos rather than strict equality, and no requirement for sa_mobile to be set) in the WooCommerce registration handler, allowing cross-form session reuse to bypass phone ownership verification. This makes it possible for unauthenticated attackers to log in as any existing user whose phone number is known by completing OTP verification on any other integrated form handler and then submitting the WooCommerce registration form with the victim's phone number.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: SMS Alert 3.9.8 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts