High severity8.8NVD Advisory· Published May 10, 2025· Updated Jun 17, 2026
CVE-2025-3876
CVE-2025-3876
Description
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=3.8.1
- cozyvision1/SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recoveryv5Range: 0
Patches
Vulnerability mechanics
References
5- plugins.trac.wordpress.org/changeset/3290478/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.phpnvdProduct
- plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.phpnvdProduct
- wordpress.org/plugins/sms-alert/nvdRelease Notes
News mentions
0No linked articles in our index yet.