CVE-2026-54803: WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

Synopsis

An authentication bypass leading to privilege escalation affects the SMS Alert Order Notifications WordPress plugin by Cozy Vision Technologies Pvt. Ltd., versions 3.9.4 and below. The vulnerability is reachable over the network with no authentication required and no user interaction needed, allowing any remote attacker to escalate a subscriber-level account to a higher privilege role. Successful exploitation gives the attacker full read, write, and availability impact on the affected WordPress installation. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, meaning an attacker can send malicious requests from anywhere on the internet without needing a foothold on the host.

• AuthenticationNot required

  No credentials are needed to trigger the privilege escalation; the vulnerability can be reached by any unauthenticated remote party.

• Victim interactionNot required

  The attack is fully automated and does not require a logged-in user to click a link, visit a page, or perform any other action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race timing, specific memory layout, or environmental configuration.

Blast Radius

• An attacker escalates an unprivileged or subscriber-level WordPress account to a higher role, gaining administrative control over site content, users, and settings.
• With elevated privileges, the attacker reads sensitive stored data including order details, customer records, and SMS notification credentials held by the plugin.
• The attacker modifies or deletes site content, installs malicious plugins or themes, and alters plugin configuration to intercept or redirect SMS alerts.
• The attacker disrupts service availability by removing critical configuration, deactivating plugins, or locking legitimate administrators out of the WordPress dashboard.