CVE-2026-11387 is a critical improper authentication vulnerability in the cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin. The plugin fails to properly validate user identity before allowing updates to user details such as email addresses. This enables unauthenticated attackers to change any user's email address, including administrators, and subsequently reset their passwords via OTP verification if enabled and configured with a phone number. The vulnerability affects all plugin versions up to and including 3.9.5. No official patch or remediation guidance is currently documented.

Successful exploitation allows unauthenticated attackers to take over any user account, including administrator accounts, by changing the user's email address and resetting their password using OTP verification. This leads to full compromise of the WordPress site with all associated confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, sites should consider disabling OTP verification for password resets or removing phone numbers from user profiles to reduce exposure. Monitoring for suspicious account changes and restricting plugin usage may also help mitigate risk.