Privilege Escalation via Account Takeover in SMS Alert WooCommerce Plugin

Executive Summary

The vulnerability exists in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress, affecting all versions up to and including 3.9.5.

It allows unauthenticated attackers to escalate privileges by taking over user accounts. This happens because the plugin does not properly verify a user's identity before allowing updates to sensitive details such as email addresses.

Attackers can change the email address of any user, including administrators, and then use that to reset the user's password via OTP verification, gaining full access to the account.

This vulnerability only affects sites that have OTP verification enabled for password resets and where the targeted user has a phone number set for OTP verification.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to gain unauthorized access to user accounts, including administrator accounts.

Once an attacker takes over an administrator account, they can control the entire WordPress site, potentially leading to data theft, site defacement, installation of malicious code, or complete site takeover.

The CVSS score of 9.8 indicates a critical severity, meaning the vulnerability is easy to exploit remotely without any privileges or user interaction, and it results in high confidentiality, integrity, and availability impacts.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the SMS Alert – SMS & OTP for WooCommerce plugin to a version later than 3.9.5 where the issue is fixed.

Additionally, consider disabling OTP verification for password resets until the plugin is updated, especially if administrators or users have phone numbers set for OTP verification.

Review user accounts for any unauthorized changes, particularly email addresses and passwords, and monitor for suspicious activity.

Useful 0 Not Useful 0