The SMS Alert – SMS & OTP for WooCommerce plugin improperly relies on the HTTP Host header to determine if it is operating in a playground environment. This design flaw allows an attacker to spoof the Host header, triggering the plugin to accept a static OTP code "1234" for authentication. Consequently, an unauthenticated attacker can bypass normal authentication controls and gain access to any user account, including those with administrative privileges. This vulnerability affects all versions up to 3.7.9 and is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to bypass authentication and escalate privileges to any user account, including administrators. This compromises the confidentiality, integrity, and availability of the affected WordPress site and its data. Attackers can perform any actions permitted to the compromised accounts, potentially leading to full site takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to the affected functionality. Monitor for vendor updates and apply patches promptly once released. Avoid relying on the Host header for security decisions as a best practice.