CVE-2025-3876: SMS Alert Order Notifications Privilege Escalation

CVE-2025-3876 Overview

CVE-2025-3876 is a privilege escalation vulnerability in the SMS Alert Order Notifications WooCommerce plugin for WordPress. The flaw resides in the handleWpLoginCreateUserAction() function and affects all versions up to and including 3.8.1. Insufficient One-Time Password (OTP) validation allows authenticated attackers with Subscriber-level access or higher to impersonate any account by supplying its username or email address. Successful exploitation elevates an attacker's privileges to administrator. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with low-privilege accounts can take over administrator accounts on any WordPress site running the vulnerable plugin, leading to full site compromise.

Affected Products

Cozyvision SMS Alert Order Notifications for WooCommerce (WordPress plugin)
All versions up to and including 3.8.1
Free WordPress.org distribution of the sms-alert plugin

Discovery Timeline

2025-05-10 - CVE-2025-3876 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-3876

Vulnerability Analysis

The vulnerability exists in the plugin's WordPress login handler, specifically the handleWpLoginCreateUserAction() function located in handler/forms/class-wplogin.php. This function is responsible for processing OTP-based authentication and user creation flows triggered through the SMS Alert integration. The handler accepts a user-supplied identifier (username or email) and proceeds to authenticate the requester as that account without correctly validating that the submitted OTP belongs to the targeted user.

Because the OTP check is not properly bound to the requested account, an attacker who already holds a low-privilege session can target any existing user, including site administrators. The plugin then completes the login transition using WordPress's session APIs, returning a valid authenticated session for the impersonated account. This converts a Subscriber-level foothold into full administrative control of the WordPress instance.

Root Cause

The root cause is missing authorization combined with insufficient OTP validation logic. The code path treats the OTP submission as proof of ownership for whichever account name is supplied in the request, rather than enforcing a strict, server-side binding between an issued OTP and the user it was generated for. See the vendor code review at class-wplogin.php line 145 and class-wplogin.php line 447.

Attack Vector

The attack is remote and network-based. An attacker first registers or compromises a Subscriber-level account on a target site, then issues a crafted POST request to the plugin's login handler endpoint, supplying the username or email of an administrator. The handler returns an authenticated administrator session without validating that the OTP was actually issued to that target user. See the Wordfence advisory for additional technical context.

Detection Methods for CVE-2025-3876

Indicators of Compromise

Unexpected role changes on existing user accounts, particularly Subscriber accounts being promoted to Administrator
Authentication events in wp-login.php or plugin AJAX endpoints originating from low-privilege users immediately followed by administrator-context actions
Plugin installations, theme edits, or option changes performed by accounts that historically only placed orders
New administrator accounts created shortly after SMS Alert OTP submission requests

Detection Strategies

Inspect WordPress access logs for POST requests targeting the SMS Alert handler routes referencing handleWpLoginCreateUserAction or class-wplogin.php
Correlate OTP submission requests with the username or email parameter and flag cases where the requesting session belongs to a different account
Audit the wp_users and wp_usermeta tables for unexpected entries in wp_capabilities mapping low-privilege accounts to administrator

Monitoring Recommendations

Enable a WordPress activity log plugin and forward events to a centralized SIEM or data lake for retention and correlation
Alert on any privilege role change event, especially transitions from subscriber or customer to administrator
Monitor outbound traffic from the web host for indicators of webshell deployment or plugin tampering following suspicious logins

How to Mitigate CVE-2025-3876

Immediate Actions Required

Update the SMS Alert Order Notifications WooCommerce plugin to a version newer than 3.8.1 that includes the fix from changeset 3290478
Audit all WordPress user accounts and remove any unauthorized administrators or unexpected role escalations
Force a password reset for all administrator accounts and invalidate existing authentication cookies
Review recent plugin, theme, and core file modifications for unauthorized changes

Patch Information

The vendor addressed the issue in the plugin's source repository via WordPress.org changeset 3290478. Site administrators should update through the WordPress plugin dashboard or download the latest release from the SMS Alert plugin page. Confirm the installed version is greater than 3.8.1 after updating.

Workarounds

If patching cannot be performed immediately, deactivate and delete the SMS Alert Order Notifications plugin
Restrict new user registration on the WordPress site to prevent attackers from obtaining the Subscriber-level access required for exploitation
Place the site behind a web application firewall (WAF) rule that blocks requests to the plugin's OTP handler endpoints from unauthenticated or low-privilege contexts
Enforce two-factor authentication on all administrator accounts through a separate, trusted plugin to limit impact of session takeover

bash

# Configuration example: disable open registration in wp-config.php / WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber

# Verify installed plugin version and update
wp plugin get sms-alert --field=version
wp plugin update sms-alert