CVE-2026-1833 describes a missing authorization (CWE-862) vulnerability in the sm_rasmy WaMate Confirm – Order Confirmation WordPress plugin. The plugin fails to properly verify that a user is authorized to perform certain actions, specifically blocking and unblocking phone numbers. As a result, any authenticated user with subscriber-level privileges or above can perform these restricted actions. The vulnerability affects all versions up to and including 2.0.1. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but limited integrity impact.

An attacker with subscriber-level access or higher can abuse the vulnerability to block or unblock phone numbers within the plugin, potentially disrupting normal operations or causing unauthorized changes. There is no direct confidentiality or availability impact reported. The integrity of the phone number blocking functionality is compromised, which could affect business processes relying on this feature.

Patch status is not yet confirmed as no patch or official fix is currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, restrict subscriber-level access to trusted users only and consider disabling the plugin if the risk is unacceptable.