CVE-2025-14948
Unauthorized Data Modification in miniOrange WooCommerce SMS Notification Plugin
Publication date: 2026-01-10
Last updated on: 2026-01-10
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| miniorange | miniorange_otp_verification_and_sms_notification_for_woocommerce | to 4.3.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the miniOrange OTP Verification and SMS Notification for WooCommerce WordPress plugin (up to version 4.3.8). It is caused by a missing capability check on the AJAX action `enable_wc_sms_notification`. This flaw allows unauthenticated attackers to modify SMS notification settings for WooCommerce orders by enabling or disabling them without proper authorization. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers who are not logged in to change SMS notification settings for WooCommerce orders. This could lead to unauthorized enabling or disabling of SMS notifications, potentially disrupting communication with customers or administrators about order statuses, which may affect order processing and customer experience. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if unauthorized users can invoke the AJAX action `enable_wc_sms_notification` to enable or disable SMS notifications without proper authentication. You can monitor HTTP requests to your WordPress site for POST requests to `admin-ajax.php` with the action parameter set to `enable_wc_sms_notification`. For example, using command-line tools like curl or network monitoring tools, you can look for such requests. A sample curl command to test this might be: curl -X POST -d 'action=enable_wc_sms_notification' https://yourwordpresssite.com/wp-admin/admin-ajax.php If this request succeeds without authentication or proper capability checks, your site is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the miniOrange OTP Verification and SMS Notification for WooCommerce plugin to a version later than 4.3.8 where this vulnerability is fixed. If an update is not immediately available, restrict access to the AJAX action `enable_wc_sms_notification` by implementing additional access controls, such as limiting admin-ajax.php access via firewall rules or plugins that restrict AJAX actions to authenticated users only. Additionally, monitor your site for suspicious AJAX requests related to SMS notification settings and review your WooCommerce SMS notification configurations for unauthorized changes. [1]