The SMS Alert Order Notifications – WooCommerce plugin for WordPress suffers from a missing authorization check (CWE-862) in the handleWpLoginCreateUserAction() function. This allows authenticated users with low privileges (Subscriber and above) to bypass OTP validation and impersonate any user by submitting their username or email. Successful exploitation results in privilege escalation to administrator level, enabling full control over the WordPress site. The vulnerability affects all plugin versions up to and including 3.8.1. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges of low, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor-provided patch or advisory available at this time.

An attacker with authenticated Subscriber-level access or higher can impersonate any user account, including administrators, by exploiting insufficient OTP validation. This leads to full administrative control over the WordPress site, compromising confidentiality, integrity, and availability of the system and data. The vulnerability is rated high severity with a CVSS score of 8.8. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious account activity. Avoid installing or updating to vulnerable versions of the plugin. Consider disabling the plugin temporarily if administrative risk is unacceptable.