CVE-2026-95594

Summary

The SMS Alert Order Notifications plugin has an incorrect privilege assignment vulnerability that allows unauthenticated users to escalate privileges and gain administrative access. This means attackers can potentially take full control of affected systems without needing valid credentials.

Exploitability

Exploitation requires no authentication and is relatively straightforward, with attackers able to escalate privileges through a predictable workflow that doesn't require complex preconditions or specific system states.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise WordPress sites using the plugin, potentially leading to data breaches, unauthorized content modifications, and complete system takeover across all affected installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.0.1 or later immediately, as this release specifically addresses the privilege escalation issue in the SMS Alert Order Notifications plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.