An attacker can exploit an Incorrect Privilege Assignment flaw in the Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications plugin, allowing privilege escalation. The vulnerability affects all versions from n/a through 4.0.0 and can be triggered by accessing plugin endpoints that lack proper authorization checks, enabling the attacker to perform actions reserved for administrators. This flaw is a classic example of improper authorization control (CWE-266) that may lead to unauthorized content modification, policy changes, or the installation of malicious plugins. The impact is broad: any WordPress site using this plugin at or below version 4.0.0 is susceptible. Attackers who succeed can gain full administrative rights within the affected WordPress installation, potentially compromising the entire site and customer data. The CVSS score of 8.1 indicates high severity, while the EPSS score of 0.00236 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is through exposed plugin endpoints or pages that accept inputs without confirming the user's authentication state. Once an attacker achieves privilege escalation, they could effectively control the website, leading to confidentiality and integrity breach for both site owners and visitors.

The vulnerability affects WordPress websites that have the SMS Alert Order Notifications plugin installed from Cozy Vision Technologies Pvt. Ltd. at a version of 4.0.0 or earlier. No other vendor or product versions are indicated as affected. The vulnerability cannot be mitigated by removing WordPress itself.

The CVSS score of 8.1 reflects a high‑severity vulnerability. The EPSS score of 0.00236 indicates a very low probability of exploitation, and the issue is not listed in CISA's KEV catalog. The threat is that unauthenticated users can reach plugin endpoints that lack proper authorization checks, enabling them to elevate privileges to administrator level. If exploited, an attacker can manipulate site content, change settings, and install additional malicious plugins, effectively commandeering the entire WordPress site.