CVE-2025-3876: SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
First published: Sat May 10 2025(Updated: )
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WooCommerce SMS Alert Order Notifications | <=3.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145
- https://wordpress.org/plugins/sms-alert/#developers
- https://plugins.trac.wordpress.org/changeset/3290478/
Frequently Asked Questions
What is the severity of CVE-2025-3876?
CVE-2025-3876 is classified as a privilege escalation vulnerability due to insufficient user OTP validation.
How do I fix CVE-2025-3876?
To remediate CVE-2025-3876, update the WooCommerce SMS Alert Order Notifications plugin to version 3.8.2 or higher.
Who is affected by CVE-2025-3876?
All users of the WooCommerce SMS Alert Order Notifications plugin versions up to and including 3.8.1 are affected by CVE-2025-3876.
What does CVE-2025-3876 allow an attacker to do?
CVE-2025-3876 allows an authenticated attacker to escalate their privileges due to a lack of proper OTP validation.
When was CVE-2025-3876 disclosed?
CVE-2025-3876 was disclosed on October 17, 2025.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/type
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/event
- vendor/woocommerce
- canonical/woocommerce sms alert order notifications