CVE-2026-116386

Summary

The SMS Alert Order Notifications plugin for WordPress versions <= 4.0.2 contains an unauthenticated privilege escalation vulnerability (CWE-266), allowing any remote attacker to gain elevated privileges without authentication.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication requirements and low attack complexity.

Blast radius

Successful exploitation could lead to full compromise of the WordPress site, including unauthorized data access, modification of site content or settings, and potential lateral movement within the hosting infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.0.3 or later of the SMS Alert Order Notifications plugin, as this is the first fixed version that addresses CVE-2026-116386.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.