WordPress plugin
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical6
- High9
- Medium14
- Low1
All SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.3 | Unauthenticated Privilege Escalation ≤4.0.2Update to 4.0.3 | CVE-2026-116386 | |
| Critical9.8 | Unauthenticated Arbitrary Account Takeover ≤4.0.0Update to 4.0.1 | CVE-2026-94256 | |
| High7.3 | 4.0.0 - Unauthenticated Privilege Escalation 3.9.6 – 4.0.0Update to 4.0.1 | CVE-2026-94257 | |
| High7.3 | Unauthenticated Privilege Escalation ≤4.0.0Update to 4.0.1 | CVE-2026-95594 | |
| Critical9.8 | Authentication Bypass via Account Takeover <3.9.8Update to 3.9.8 | CVE-2026-15206 | |
| High7.3 | Unauthenticated Privilege Escalation ≤3.9.7Update to 3.9.8 | CVE-2026-66424 | |
| Critical9.8 | Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter ≤3.9.7Update to 3.9.8 | CVE-2026-15014 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤3.9.6Update to 3.9.7 | CVE-2026-59540 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Arbitrary Password Reset ≤3.9.5Update to 3.9.6 | CVE-2026-11387 | |
| High7.5 | Unauthenticated SQL Injection ≤3.8.5Update to 3.8.6 | CVE-2025-49915 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function ≤3.8.1Update to 3.8.2 | CVE-2025-3876 | |
| High7.5 | Unauthenticated SQL Injection ≤3.8.1Update to 3.8.2 | CVE-2025-47682 | |
| Critical9.8 | Unauthenticated Account Takeover/Privilege Escalation ≤3.7.9Update to 3.8.0 | CVE-2024-13553 | |
| High7.5 | Unauthenticated SQL Injection ≤3.7.8Update to 3.7.9 | CVE-2025-26988 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update ≤3.7.6Update to 3.7.7 | CVE-2024-11725 |
- High7.3Unauthenticated Privilege Escalation
≤4.0.2Update to 4.0.3
- Critical9.8Unauthenticated Arbitrary Account Takeover
≤4.0.0Update to 4.0.1
- High7.34.0.0 - Unauthenticated Privilege Escalation
3.9.6 – 4.0.0Update to 4.0.1
- High7.3Unauthenticated Privilege Escalation
≤4.0.0Update to 4.0.1
- Critical9.8Authentication Bypass via Account Takeover
<3.9.8Update to 3.9.8
- High7.3Unauthenticated Privilege Escalation
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Privilege Escalation
≤3.9.6Update to 3.9.7
- Critical9.8Unauthenticated Privilege Escalation via Arbitrary Password Reset
≤3.9.5Update to 3.9.6
- High7.5Unauthenticated SQL Injection
≤3.8.5Update to 3.8.6
- High8.8Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
≤3.8.1Update to 3.8.2
- High7.5Unauthenticated SQL Injection
≤3.8.1Update to 3.8.2
- Critical9.8Unauthenticated Account Takeover/Privilege Escalation
≤3.7.9Update to 3.8.0
- High7.5Unauthenticated SQL Injection
≤3.7.8Update to 3.7.9
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
≤3.7.6Update to 3.7.7
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery: common questions
Does SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery: 6 critical, 9 high, 14 medium, 1 low. None are known to affect version null.
How do I check which version of SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerability?
CVE-2026-116386, published Oct 30, 2026: SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.2 - Unauthenticated Privilege Escalation. Severity: High (CVSS 7.3).
Is any SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerability listed in CISA KEV?
No. None of the known SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerabilities is currently listed in the CISA KEV catalog.