The vulnerability in the SMS Alert Order Notifications plugin lies in insufficient OTP validation within the handleWpLoginCreateUserAction function. It allows an authenticated user with Subscriber-level access or higher to supply any username or email and impersonate that account. By doing so, the attacker can elevate their own privileges to match the target account, effectively gaining administrator rights. This weakness is a clear case of improper authorization (CWE-862).

The affected product is the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin from CozyVision, version 3.8.1 and all earlier releases. The flaw exists in the code base managed under the "sms-alert" plugin folder for WordPress. Users running any version up to and including 3.8.1 are impacted; newer releases are not listed as vulnerable.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is less than 1%, indicating a low probability of exploitation at the moment. The vulnerability is not yet listed in the CISA KEV catalog. The exploit requires that an attacker first authenticate as a Subscriber or higher role; from that point the attacker can supply a target username or email and trigger the handleWpLoginCreateUserAction function to perform the privilege escalation. The attack vector is inferred to be via legitimate authenticated access within the WordPress administrative interface or through any authenticated backend calls that invoke the function.