CVE-2026-62106: WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability
Published Sep 11, 2026
·Updated
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.
Affected Software
1 affected component
wordpress/SMS Alert Order Notifications<=3.9.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress SMS Alert Order Notifications pluginto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Sep 11, 2026
CVE Published
via MITRE·06:12 PM
Data Sourced
via MITRE·06:12 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account?
Yes. The CVSS vector indicates low privileges are required, so an unauthenticated visitor alone is not sufficient to exploit the issue. User interaction is not required.
2
How can I determine whether my site is affected?
Check the installed version of the SMS Alert Order Notifications plugin. Versions 3.9.9 and earlier are identified as affected.
3
What is the potential impact of successful exploitation?
Successful exploitation can lead to privilege escalation. The CVSS assessment indicates high potential impact to confidentiality, integrity, and availability.