{"id":"CVE-2026-116386","published":"2026-10-30T19:18:13.640","lastModified":"2026-10-30T19:22:27.173","description":"Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-4-0-2-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SMS Alert Order Notifications plugin for WordPress versions <= 4.0.2 contains an unauthenticated privilege escalation vulnerability (CWE-266), allowing any remote attacker to gain elevated privileges without authentication.","exploitability":"Exploitation is straightforward for remote attackers due to the lack of authentication requirements and low attack complexity.","blast_radius":"Successful exploitation could lead to full compromise of the WordPress site, including unauthorized data access, modification of site content or settings, and potential lateral movement within the hosting infrastructure.","remediation":"Upgrade to version 4.0.3 or later of the SMS Alert Order Notifications plugin, as this is the first fixed version that addresses CVE-2026-116386.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","unauthenticated","wordpress-plugin","cwe-266"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:59.645Z"}}