The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin is vulnerable to CSRF due to improper nonce validation in the processBulkAction function. This allows unauthenticated attackers to perform unauthorized actions such as deleting pages and posts if an administrator is tricked into executing a forged request. The vulnerability affects all versions up to and including 3.6.9. No known exploits are reported in the wild, and no official patch or fix has been documented.

Exploitation of this vulnerability can lead to unauthorized deletion of WordPress pages and posts by leveraging CSRF attacks against site administrators. While it does not impact confidentiality or availability directly, it can cause integrity loss of website content. The attack requires user interaction (an administrator clicking a malicious link) and does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links, especially from untrusted sources. Implementing additional CSRF protections or disabling the vulnerable plugin temporarily may reduce risk.