Live › vulnerability › CVE-2026-116386
The SMS Alert Order Notifications plugin for WordPress, versions 4.0.2 and earlier, lets an unauthenticated visitor gain elevated privileges. An attacker can take control of a WordPress site without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the SMS Alert Order Notifications plugin at version 4.0.2 or earlier are exposed. Sites without this plugin, or running a later version, are not affected by this entry. The sources do not describe the exact code path or configuration required.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sms-alert | wordpress | <= 4.0.2 | – |
4.0.2 or earlier is affected4.0.34.0.3 fixes this CVEEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116386")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.