Executive Summary

The vulnerability exists in the miniOrange OTP Verification and SMS Notification for WooCommerce WordPress plugin (up to version 4.3.8). It is caused by a missing capability check on the AJAX action `enable_wc_sms_notification`. This flaw allows unauthenticated attackers to modify SMS notification settings for WooCommerce orders by enabling or disabling them without proper authorization. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who are not logged in to change SMS notification settings for WooCommerce orders. This could lead to unauthorized enabling or disabling of SMS notifications, potentially disrupting communication with customers or administrators about order statuses, which may affect order processing and customer experience. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if unauthorized users can invoke the AJAX action `enable_wc_sms_notification` to enable or disable SMS notifications without proper authentication. You can monitor HTTP requests to your WordPress site for POST requests to `admin-ajax.php` with the action parameter set to `enable_wc_sms_notification`. For example, using command-line tools like curl or network monitoring tools, you can look for such requests. A sample curl command to test this might be: curl -X POST -d 'action=enable_wc_sms_notification' https://yourwordpresssite.com/wp-admin/admin-ajax.php If this request succeeds without authentication or proper capability checks, your site is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the miniOrange OTP Verification and SMS Notification for WooCommerce plugin to a version later than 4.3.8 where this vulnerability is fixed. If an update is not immediately available, restrict access to the AJAX action `enable_wc_sms_notification` by implementing additional access controls, such as limiting admin-ajax.php access via firewall rules or plugins that restrict AJAX actions to authenticated users only. Additionally, monitor your site for suspicious AJAX requests related to SMS notification settings and review your WooCommerce SMS notification configurations for unauthorized changes. [1]

Useful 0 Not Useful 0