---
id: "CVE-2026-116386"
kind: "vulnerability"
aliases: ["CVE-2026-116386"]
title: "SMS Alert Order Notifications WordPress plugin: unauthenticated privilege escalation"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "sms-alert", "fixed": [], "affected": "<= 4.0.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "sms-alert", "sms-alert-order-notifications", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-4.0.3-or-later"]
published_at: "2026-10-30T19:18:13+00:00"
first_seen_at: "2026-10-30T19:25:28+00:00"
updated_at: "2026-10-30T19:30:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116386", "first_seen_at": "2026-10-30T19:25:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:30:21+00:00"}]
---

# SMS Alert Order Notifications WordPress plugin: unauthenticated privilege escalation

The SMS Alert Order Notifications plugin for WordPress, versions 4.0.2 and earlier, lets an unauthenticated visitor gain elevated privileges. An attacker can take control of a WordPress site without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:sms-alert affected <= 4.0.2 fixed ?

## How to check

WordPress admin > Plugins: find SMS Alert (folder wp-content/plugins/sms-alert/), version 4.0.2 or earlier is affected. Or run: wp plugin get sms-alert --field=version

## Fix

Update the SMS Alert plugin to the latest release (4.0.3 at 2026-10-28). Unconfirmed: no changelog read stating 4.0.3 fixes this CVE.

## Timeline

- 2026-10-30T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116386
- 2026-10-30T19:30:21+00:00 analyst — NVD page not readable by my tools; no vendor changelog or advisory for this CVE found. Description only says unauthenticated privilege escalation in <=4.0.2 (Patchstack CVSS 9.8). wordpress.org API shows latest release 4.0.3 (2026-10-28), so 4.0.3 is the likely fix, but I could not confirm it from a changelog; nothing marked verified. Endpoint and mechanism unknown. Earlier sibling CVEs in this plugin were OTP login/password-reset/registration flows, which hints at the same area but is not confirmed for this one. No exploitation or PoC found.

## Documents

- [advisory] NVD CVE-2026-116386 https://nvd.nist.gov/vuln/detail/CVE-2026-116386
- [mentions] WordPress.org plugin info: sms-alert latest 4.0.3 (2026-10-28) https://api.wordpress.org/plugins/info/1.0/sms-alert.json
- [mentions] Patchstack: sms-alert vulnerability history https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerabilities

## From the sources

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_