This vulnerability arises from a missing authorization check in the Cozy Vision WordPress SMS Alert Order Notifications plugin. As a result, an attacker can gain unintended access to order notification data or control notification settings. The weakness is a classic access control flaw (CWE‑862), potentially allowing the disclosure or tampering of sensitive order information and the unauthorized sending of alerts, thereby affecting confidentiality and integrity of e‑commerce operations.

All versions of the Cozy Vision SMS Alert Order Notifications plugin up to and including 3.9.0 are affected, regardless of specific minor releases. The issue is tied to the plugin’s SMS Alert Order Notifications component and does not extend beyond it as identified in the vendor advisory.

The vulnerability is scored CVSS 5.4, indicating a moderate severity. The EPSS score is below 1%, suggesting that real‑world exploitation is currently unlikely. It is not listed in the CISA KEV catalog. Exploitation probably requires remote access to a WordPress site where the plugin is installed; an attacker may need a valid user session or exploit misconfigured site permissions to trigger the missing authorization check.