{"id":"CVE-2026-116386","kind":"vulnerability","aliases":["CVE-2026-116386"],"related":[],"title":"SMS Alert Order Notifications WordPress plugin: unauthenticated privilege escalation","description":"Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.","summary":"The SMS Alert Order Notifications plugin for WordPress, versions 4.0.2 and earlier, lets an unauthenticated visitor gain elevated privileges. An attacker can take control of a WordPress site without logging in.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sms-alert","fixed":[],"affected":"<= 4.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","sms-alert","sms-alert-order-notifications","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-4.0.3-or-later"],"how_to_check":"WordPress admin > Plugins: find SMS Alert (folder wp-content/plugins/sms-alert/), version 4.0.2 or earlier is affected. Or run: wp plugin get sms-alert --field=version","fix":"Update the SMS Alert plugin to the latest release (4.0.3 at 2026-10-28). Unconfirmed: no changelog read stating 4.0.3 fixes this CVE.","status":"open","published_at":"2026-10-30T19:18:13+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:45+00:00","updated_at":"2026-10-30T19:30:21+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:25:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SMS Alert Order Notifications WordPress plugin: unauthenticated privilege escalation","impact":"high","summary":"The SMS Alert Order Notifications plugin for WordPress, versions 4.0.2 and earlier, lets an unauthenticated visitor gain elevated privileges. An attacker can take control of a WordPress site without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","sms-alert-order-notifications"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker gains administrator-level control of the WordPress site","analyst_note":"Find the fixed plugin version and the vulnerable endpoint from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116386 or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the SMS Alert Order Notifications folder.\n- Confirm whether the installed version is `4.0.2` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the SMS Alert Order Notifications plugin at version 4.0.2 or earlier are exposed. Sites without this plugin, or running a later version, are not affected by this entry. The sources do not describe the exact code path or configuration required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000697,"input_tokens":4067,"output_tokens":580,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and the vulnerable endpoint from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116386 or the plugin's changelog.","search":"'-116386':12A,15A '-2026':11A,14A '4.0.2':39B,68C 'alert':2A,18A,22B,25B,32B,65C 'attack':50B 'control':53B 'cve':10A,13A 'earlier':41B 'elev':47B 'escal':9A,62C 'gain':46B 'let':42B 'log':59B 'notif':4A,27B,34B,67C 'order':3A,26B,33B,66C 'packag':19B 'plugin':6A,35B 'privileg':8A,48B,61C 'site':57B 'sms':1A,17A,21B,24B,31B,64C 'sms-alert':16A,20B 'sms-alert-order-notif':23B 'take':52B 'unauthent':7A,44B,60C 'version':38B,69C 'visitor':45B 'without':58B 'woocommerc':28B 'wordpress':5A,29B,37B,56B","nicknames":[],"mitigations":[],"who_affected":"Sites running the SMS Alert Order Notifications plugin at version 4.0.2 or earlier are exposed. Sites without this plugin, or running a later version, are not affected by this entry. The sources do not describe the exact code path or configuration required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116386","severity":null,"published_at":"2026-10-30T19:18:13+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116386:1194","url":null,"severity":null,"published_at":"2026-10-30T19:30:21+00:00","modified_at":"2026-10-30T19:30:21+00:00","first_seen_at":"2026-10-30T19:30:21+00:00","fetched_at":"2026-10-30T19:30:21+00:00","note":"NVD page not readable by my tools; no vendor changelog or advisory for this CVE found. Description only says unauthenticated privilege escalation in <=4.0.2 (Patchstack CVSS 9.8). wordpress.org API shows latest release 4.0.3 (2026-10-28), so 4.0.3 is the likely fix, but I could not confirm it from a changelog; nothing marked verified. Endpoint and mechanism unknown. Earlier sibling CVEs in this plugin were OTP login/password-reset/registration flows, which hints at the same area but is not confirmed for this one. No exploitation or PoC found."}],"documents":[{"id":25515,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116386","title":"NVD CVE-2026-116386","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25516,"url":"https://api.wordpress.org/plugins/info/1.0/sms-alert.json","title":"WordPress.org plugin info: sms-alert latest 4.0.3 (2026-10-28)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":25517,"url":"https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerabilities","title":"Patchstack: sms-alert vulnerability history","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}