The miniOrange OTP Verification and SMS Notification for WooCommerce plugin lacks a capability check on the enable_wc_sms_notification AJAX action in all versions up to 4.3.8. This omission allows any unauthenticated user to trigger the action and enable or disable SMS notification settings for WooCommerce orders. The resulting privilege‑bypass can alter order communication behavior, potentially preventing customers from receiving order confirmations or allowing attackers to disable security notifications.

The vulnerable component is the WordPress plugin "miniOrange OTP Verification and SMS Notification for WooCommerce" by cyberlord92. All releases with a version number of 4.3.8 or earlier are impacted. Site operators using these versions on WooCommerce‑based e‑commerce sites that rely on SMS notifications for order updates are at risk.

The CVSS score of 5.3 indicates moderate impact, and the EPSS value of less than 1 % suggests a low probability of exploitation at this time. The weakness is classified as CWE‑862 (Missing Authorization). Exploitation requires only a crafted AJAX request to the vulnerable endpoint and does not require authenticated access, making the attack vector remote and straightforward for attackers who discover the endpoint.