Unauthenticated broken authentication in the WordPress SMS Alert Order Notifications plugin (versions <=3.9.3) allows an attacker to log in without valid credentials. The vulnerability stems from insufficient authentication checks when accessing plugin functions, classified as CWE‑862. An attacker who exploits it can gain the same privileges as a legitimate user, potentially accessing sensitive order data and performing actions within the WordPress administrative interface.

Cozy Vision Technologies Pvt. Ltd. has produced the SMS Alert Order Notifications plugin for WordPress. Versions up to and including 3.9.3 are affected. Any installation of these versions on a WordPress site exposes the authentication bypass flaw.

The CVSS score of 7.5 indicates high severity. Without an available EPSS score, the current exploitation probability is uncertain, but the lack of a KEV listing suggests no confirmed widespread exploitation. Likely attack vectors involve direct HTTP requests to the plugin’s authentication endpoints that do not enforce proper session handling, enabling attackers to impersonate users without credentials.