---
id: "CVE-2026-110882"
kind: "vulnerability"
aliases: ["CVE-2026-110882"]
title: "SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-17T19:16:28+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:39:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110882", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1

The SMS Alert Order Notifications plugin (sms-alert) for WordPress fails to enforce access control on some functionality, per its CVE entry. The sources say an attacker can exploit incorrectly configured access control levels, but do not describe what data or actions become reachable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the sms-alert plugin in the WordPress admin plugin list; versions through `4.0.1` are listed as affected.
- unknown for other checks: the sources do not say which endpoint or setting is involved.

## Fix

- Update the SMS Alert Order Notifications (sms-alert) plugin to a version later than `4.0.1`, if the vendor has released one; the sources do not name a fixed version.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110882

## From the sources

Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_