CVE-2026-110882: WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability requires low-privileged access. It is remotely reachable and does not require user interaction.

Q: What is the likely security impact?

The reported impact is limited to integrity. The supplied severity vector indicates no confidentiality or availability impact.

Q: Which plugin versions are affected?

SMS Alert Order Notifications versions through 4.0.1 are affected. The available data does not identify a fixed version.

Published Oct 17, 2026

Updated

Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.

Affected Software

1 affected component

Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications<=4.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/sms-alert-order-notifications to a version that resolves this vulnerability.
Fixed in 4.0.2

Event History

Oct 17, 2026

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability requires low-privileged access. It is remotely reachable and does not require user interaction.

What is the likely security impact?