Volerion logoVolerion
Volerion logoVolerion

miniOrange OTP Verification and SMS Notification for WooCommerce Missing Authorization Vulnerability

Vulnerability

A vulnerability exists in the miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress, in versions through 4.3.8. The issue arises from a lack of proper capability checks on the 'enable_wc_sms_notification' AJAX action, allowing unauthenticated attackers to unauthorizedly modify SMS notification settings for WooCommerce orders.

Impact

Exploitation of this vulnerability allows for unauthorized changes to SMS notification settings, which could disrupt order management and customer communication.

Remediation

Users are advised to update the plugin to version 4.3.9 or a newer patched version.

Added: Jan 10, 2026, 7:22 AM
Updated: Jan 10, 2026, 7:22 AM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
0.6
exploitability
8.1
remediation
7.7
relevance
2.0
threat
3.2
urgency
2.9
incentive
5.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.