CVE-2025-3876HIGH 8.8EPSS p27.6%

CVE-2025-3876CVE-2025-3876

Description

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.36% probability of exploitation · percentile 27.6% · 2026-06-19T12:03:05Z
Published2025-05-10
Last modified2025-05-21

Underlying weaknesses· 1

CWE-862

References

  1. https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145
  2. https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447
  3. https://plugins.trac.wordpress.org/changeset/3290478/
  4. https://wordpress.org/plugins/sms-alert/#developers
  5. https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=cve

1

TypeTargetConfidenceTier
WeaknessMissing Authorizationcwe-8620%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-9967
CVE
CVE-2025-8342
CVE
CVE-2025-1475
CVE
CVE-2025-10484
CVE
CVE-2025-3746
CVE
CVE-2025-3852
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.