Back to overview

CVE-2024-13553

CRITICAL
9.8
CVSS 3.1
Description
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.7.9. This is due to the plugin using the Host header to determine if the plugin is in a playground environment. This makes it possible for unauthenticated attackers to spoof the Host header to make the OTP code "1234" and authenticate as any user, including administrators.

Metadata

CVE ID
CVE-2024-13553
State
PUBLISHED
Assigner
Wordfence
Reserved
2025-01-20 20:38 UTC
Published
2025-04-01 11:12 UTC
Last updated
2026-04-08 16:51 UTC
Primary CWE
CWE-288
CWE-288 Authentication Bypass Using an Alternate Path or Cha…
Vendor / Product
cozyvision1 / SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — 0 ≤ 3.7.9
Weakness (CWE)
CWESourceDescription
CWE-288 cna CWE-288 Authentication Bypass Using an Alternate Path or Channel
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (3)
Back to overview