CVE-2026-66424

Name of the Vulnerable Software and Affected Versions SMS Alert Order Notifications versions prior to 3.9.8

Description An unauthenticated privilege escalation exists due to a shared OTP session key sa mobile verified across all form handlers and an insufficient phone number check in the WooCommerce registration handler. The handler uses strpos instead of strict equality and does not require sa mobile to be set, allowing cross-form session reuse to bypass phone ownership verification. An attacker can log in as any existing user with a known phone number by completing OTP verification on any other integrated form handler and then submitting the WooCommerce registration form with the victim's phone number.

Recommendations Update SMS Alert Order Notifications to version 3.9.8 or later.