PT-2025-14091 · WordPress · Sms Alert Order Notifications

Lucio Sá · Published 2025-04-01 · Updated 2025-04-05 · CVE-2024-13553

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.9

Description The issue allows for privilege escalation via account takeover. This is due to the plugin using the Host header to determine if it is in a playground environment, making it possible for unauthenticated attackers to spoof the Host header, set the OTP code to "1234", and authenticate as any user, including administrators.

Recommendations For versions up to, and including, 3.7.9, update to a version higher than 3.7.9 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

LPE

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2024-13553

Affected Products

Sms Alert Order Notifications

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-13553 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13553 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3248017%40sms-alert&new=3248017%40sms-alert&sfp_email=&sfph_mail= · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227241%40sms-alert&new=3227241%40sms-alert&sfp_email=&sfph_mail= · Patch
• https://t.me/purp_sec/456 · Telegram Post
• https://t.me/cvedetector/21753 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1907146862919815512 · Twitter Post
• https://twitter.com/vulns_space/status/1907049986589601866 · Twitter Post
• https://twitter.com/CveFindCom/status/1907033293616239021 · Twitter Post
• https://twitter.com/CVEnew/status/1908663708802593060 · Twitter Post
• https://t.me/cvetracker/20467 · Telegram Post
• https://t.me/cvenotify/117175 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4e444a30-11c5-4219-b4fe-635084cbac3a?source=cve · Note