The vulnerability is a missing authorization flaw in the SMS Alert Order Notifications plugin (versions up to 4.0.1). It allows an attacker to exploit incorrectly configured access controls and gain unauthorized access to the plugin’s functionalities. The impact is the potential to view or manipulate order notifications, alter SMS settings, or otherwise affect the plugin’s operation without proper authorization. This is identified as a CWE-862 weakness.

The affected product is Cozy Vision Technologies Pvt. Ltd.’s SMS Alert Order Notifications plugin for WordPress. All releases from the beginning of the product’s existence through version 4.0.1 are vulnerable; versions 4.0.2 and later contain the fix.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The attack vector is likely via a WordPress user who has any authenticated session and can interact with the plugin; escaping the plugin’s access restrictions would enable the attacker to perform unauthorized actions. Because the flaw is a broken access control, exploitation does not require user credentials beyond those provided by a logged‑in user with any role on the site, making this a low‑barrier attack in environments where the plugin is accessible.