PT-2026-1760 · Unknown+1 · Woocommerce+1

Abdualrhman Muzamil · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2025-14948

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress versions through 4.3.8

Description The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is subject to unauthorized data modification. A missing capability check on the enable wc sms notification AJAX action allows unauthenticated attackers to enable or disable SMS notification settings for WooCommerce orders. The vulnerable component is the enable wc sms notification AJAX action.

Recommendations Update the miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress to a version later than 4.3.8.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14948

Produtos afetados

Woocommerce

Miniorange Otp Verification/Sms Notification For Woocommerce

Referências · 8

• https://t.me/cveNotify/148341 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/miniorange-sms-order-notification-otp-verification/tags/4.3.8/notifications/wcsmsnotification/handler/class-woocommercenotifications.php#L138 · Nota
• https://t.me/CVEtracker/41931 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/miniorange-sms-order-notification-otp-verification?rev=3423647 · Nota
• https://twitter.com/CVEnew/status/2009891364939448406 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/f84ddc83-2079-45b9-8354-51094581b1f8?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14948 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2009987032613822786 · Publicação no Twitter