CVE-2025-3876

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3876", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-22T16:44:57.296Z", "datePublished": "2025-05-10T11:22:45.907Z", "dateUpdated": "2026-04-08T16:40:32.082Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:32.082Z"}, "affected": [{"vendor": "cozyvision1", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator."}], "title": "SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145"}, {"url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3290478/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "timeline": [{"time": "2025-05-09T21:58:31.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-12T11:53:33.465797Z", "id": "CVE-2025-3876", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T13:20:01.378Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3876", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-12T11:53:33.465797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-12T13:19:56.760Z"}}], "cna": {"title": "SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function", "credits": [{"lang": "en", "type": "finder", "value": "wesley"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "cozyvision1", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-09T21:58:31.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447"}, {"url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145"}, {"url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3290478/"}], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:32.082Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3876", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:40:32.082Z", "dateReserved": "2025-04-22T16:44:57.296Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-10T11:22:45.907Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery", "vendor": "cozyvision1", "versions": [{"lessThanOrEqual": "3.8.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "FC050880-F7A8-436C-AD72-5E4201199421", "versionEndExcluding": "3.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator."}, {"lang": "es", "value": "El complemento SMS Alert Order Notifications \u2013 WooCommerce para WordPress es vulnerable a la Escalada de Privilegios debido a una validaci\u00f3n OTP insuficiente en la funci\u00f3n handleWpLoginCreateUserAction() en todas las versiones hasta la 3.8.1 incluida. Esto permite a atacantes autenticados, con acceso de suscriptor o superior, suplantar la identidad de cualquier cuenta proporcionando su nombre de usuario o correo electr\u00f3nico y elevar sus privilegios a los de administrador."}], "id": "CVE-2025-3876", "lastModified": "2026-06-17T09:20:50.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3876", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-12T11:53:33.465797Z", "version": "2.0.3"}}]}, "published": "2025-05-10T12:15:35.670", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3290478/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/sms-alert/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:20:59.623519+00:00", "value": {"mitigation_remediation": ["Upgrade the SMS Alert Order Notifications plugin to the latest release above 3.8.1", "If an upgrade cannot be performed immediately, temporarily disable the plugin to block exploitation", "Restrict permissions of all Subscriber-level accounts until the patch is applied", "Monitor authentication and admin activity logs for any signs of impersonation attempts"], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is the SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin from CozyVision, version 3.8.1 and all earlier releases. The flaw exists in the code base managed under the \"sms-alert\" plugin folder for WordPress. Users running any version up to and including 3.8.1 are impacted; newer releases are not listed as vulnerable.", "description_and_impact": "The vulnerability in the SMS Alert Order Notifications plugin lies in insufficient OTP validation within the handleWpLoginCreateUserAction function. It allows an authenticated user with Subscriber-level access or higher to supply any username or email and impersonate that account. By doing so, the attacker can elevate their own privileges to match the target account, effectively gaining administrator rights. This weakness is a clear case of improper authorization (CWE-862).", "risk_and_exploitability": "The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is less than 1%, indicating a low probability of exploitation at the moment. The vulnerability is not yet listed in the CISA KEV catalog. The exploit requires that an attacker first authenticate as a Subscriber or higher role; from that point the attacker can supply a target username or email and trigger the handleWpLoginCreateUserAction function to perform the privilege escalation. The attack vector is inferred to be via legitimate authenticated access within the WordPress administrative interface or through any authenticated backend calls that invoke the function."}}}}, "created": "2026-04-22T17:30:22.633096+00:00", "updated": "2026-04-22T17:30:22.633106+00:00", "vendors": []}