How do I check whether I am affected by CVE-2026-110882?

- Check the installed version of the sms-alert plugin in the WordPress admin plugin list; versions through `4.0.1` are listed as affected. - unknown for other checks: the sources do not say which endpoint or setting is involved.

What is the fix for CVE-2026-110882?

- Update the SMS Alert Order Notifications (sms-alert) plugin to a version later than `4.0.1`, if the vendor has released one; the sources do not name a fixed version.

Who is not affected by CVE-2026-110882?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-110882

Go to dashboard

medium4.3Package

SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1

The SMS Alert Order Notifications plugin (sms-alert) for WordPress fails to enforce access control on some functionality, per its CVE entry. The sources say an attacker can exploit incorrectly configured access control levels, but do not describe what data or actions become reachable.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Unknown; sources only say access control is missing.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-110882

Go to dashboard

medium4.3Package

SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Unknown; sources only say access control is missing.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources