CVE-2024-13553: SMS Alert Order Notifications Escalation

CVE-2024-13553 Overview

CVE-2024-13553 is an authentication bypass vulnerability in the SMS Alert Order Notifications WooCommerce plugin for WordPress. All versions up to and including 3.7.9 are affected. The plugin uses the HTTP Host header to determine whether it is running in a playground environment. When the playground check returns true, the one-time password (OTP) is hardcoded to 1234. Unauthenticated attackers can spoof the Host header in their request, force the OTP to the static value, and authenticate as any user, including administrators. The flaw maps to [CWE-288] Authentication Bypass Using an Alternate Path and [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can take over administrator accounts on affected WooCommerce stores, leading to full site compromise.

Affected Products

Cozyvision SMS Alert Order Notifications WooCommerce plugin for WordPress
All versions up to and including 3.7.9
WordPress installations running WooCommerce with the SMS Alert plugin enabled

Discovery Timeline

2025-04-01 - CVE-2024-13553 published to NVD
2025-05-27 - Last updated in NVD database

Technical Details for CVE-2024-13553

Vulnerability Analysis

The SMS Alert Order Notifications plugin implements an OTP-based login flow. To support testing inside the WordPress Playground sandbox, the plugin checks the request Host header against a playground hostname. When the check matches, the plugin short-circuits OTP validation and accepts the static value 1234 as a valid code. The check relies on attacker-controlled input. An unauthenticated attacker who knows or guesses a valid username, including an administrator account, can submit a login request while setting the Host header to the playground value. The plugin then accepts 1234 as the OTP and issues an authenticated session for the targeted user.

Root Cause

The root cause is trust placed in the HTTP Host header for security-relevant decisions. The Host header is supplied by the client and can be set to any value. Using it as an environment indicator to disable authentication checks violates secure design principles. The plugin lacks a server-side, tamper-resistant mechanism to distinguish a sandbox environment from a production deployment.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends an HTTP request to the plugin's OTP login endpoint with a forged Host header matching the playground environment string. The attacker supplies the target username and the OTP value 1234. The plugin returns an authenticated session for the targeted account. Targeting an administrator account results in full WordPress site takeover, including plugin installation, theme modification, and arbitrary PHP code execution through the admin interface.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13553

Indicators of Compromise

HTTP requests to the plugin's OTP login endpoint containing a Host header that does not match the site's canonical hostname
Successful administrator logins originating from IP addresses with no prior administrative history
Unexpected creation of new administrator accounts or modification of existing user roles
Installation of unfamiliar plugins or themes shortly after suspicious login events

Detection Strategies

Inspect web server access logs for requests where the Host header value differs from the server's configured hostnames or matches WordPress Playground domains
Correlate plugin OTP login endpoint requests with subsequent authenticated administrative actions
Alert on WordPress wp_login events for privileged users that lack a preceding standard password-based authentication flow

Monitoring Recommendations

Forward WordPress authentication logs and web server access logs to a centralized SIEM for correlation across hosts
Monitor file integrity for wp-content/plugins, wp-content/themes, and core PHP files to identify post-compromise modifications
Track outbound network connections from the web server for indicators of webshell beaconing or data exfiltration

How to Mitigate CVE-2024-13553

Immediate Actions Required

Update the SMS Alert Order Notifications WooCommerce plugin to a version later than 3.7.9 as soon as the vendor publishes a fix
Audit all WordPress administrator accounts and reset credentials for any account that may have been targeted
Review recent plugin and theme installations and remove any unrecognized components
Rotate WordPress secret keys in wp-config.php to invalidate existing sessions

Patch Information

The vendor has published changesets in the WordPress plugin repository that address the issue. Review the WordPress Changeset 3227241 and the WordPress Changeset 3248017 for the corrective code changes. Apply the latest plugin version available through the WordPress admin dashboard.

Workarounds

Deactivate and remove the SMS Alert Order Notifications plugin until a patched version is installed
Configure the web server or reverse proxy to reject HTTP requests whose Host header does not match an allowlist of canonical hostnames
Place the WordPress site behind a web application firewall with rules that block requests containing playground-related Host header values

bash

# Nginx example: enforce a strict Host header allowlist
server {
    listen 443 ssl;
    server_name store.example.com;

    if ($host !~* ^(store\.example\.com)$) {
        return 444;
    }

    location / {
        proxy_pass http://wordpress_backend;
        proxy_set_header Host $host;
    }
}