{"id":"CVE-2026-95594","published":"2026-10-06T09:17:57.577","lastModified":"2026-10-12T14:17:13.577","description":"Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-4-0-0-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The SMS Alert Order Notifications plugin has an incorrect privilege assignment vulnerability that allows unauthenticated users to escalate privileges and gain administrative access. This means attackers can potentially take full control of affected systems without needing valid credentials.","exploitability":"Exploitation requires no authentication and is relatively straightforward, with attackers able to escalate privileges through a predictable workflow that doesn't require complex preconditions or specific system states.","blast_radius":"If exploited, this vulnerability could allow attackers to fully compromise WordPress sites using the plugin, potentially leading to data breaches, unauthorized content modifications, and complete system takeover across all affected installations.","remediation":"Upgrade to version 4.0.1 or later immediately, as this release specifically addresses the privilege escalation issue in the SMS Alert Order Notifications plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:59:21.717Z"}}