SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.4 - Authenticated (Subscriber+) Privilege Escalation

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.9.4. This is due to missing validation that the phone number supplied at login matches the phone number that was OTP-verified in the session, allowing session token reuse across arbitrary accounts. This makes it possible for authenticated attackers, with subscriber-level access and above, to log in as any user, including administrators, without knowing the account's password by supplying an arbitrary username after completing OTP verification for a different phone number.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: SMS Alert 3.9.5 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts