This vulnerability (CWE-863) in SMS Alert Order Notifications allows an attacker to escalate privileges due to improper authorization controls. It affects versions up to and including 3.9.4. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

Successful exploitation could allow an attacker to gain unauthorized elevated privileges within the SMS Alert Order Notifications system, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system and monitor for suspicious activity related to privilege escalation attempts.