PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54802 Cozy Vision Technologies Pvt. Ltd. CVE debrief

CVE-2026-54802 is a HIGH-severity vulnerability (CVSS Score: 7.5) affecting the SMS Alert Order Notifications plugin up to version 3.9.3. This vulnerability allows unauthenticated attackers to bypass authentication due to broken authentication mechanisms. Successful exploitation could enable attackers to access sensitive information. The vulnerability was published on June 17, 2026, and immediately gained attention due to its high severity and potential impact on WordPress sites using the affected plugin. Users of this plugin should prioritize updating to a patched version to mitigate potential risks.

Vendor
Cozy Vision Technologies Pvt. Ltd.
Product
SMS Alert Order Notifications
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Administrators and security teams responsible for WordPress installations using the SMS Alert Order Notifications plugin, especially those with versions up to 3.9.3, should be aware of this vulnerability. Given its high CVSS score, immediate attention is required to assess exposure and apply necessary patches or mitigations.

Technical summary

The vulnerability, identified as CVE-2026-54802, is caused by broken authentication in the SMS Alert Order Notifications plugin. Specifically, it allows unauthenticated access due to inadequate authentication mechanisms. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that it can be exploited over the network with low attack complexity, no privileges required, and no user interaction needed, potentially leading to high confidentiality impacts.

Defensive priority

High

Recommended defensive actions

  • Immediately update the SMS Alert Order Notifications plugin to a version beyond 3.9.3 if currently using a vulnerable version.
  • Review and restrict access to sensitive areas of the WordPress site until the update can be applied.
  • Monitor site logs for any suspicious activity that could indicate exploitation attempts.
  • Consider implementing additional security measures such as two-factor authentication for all users.
  • Regularly update all plugins and themes on the WordPress site to ensure the latest security patches are applied.
  • Use a Web Application Firewall (WAF) to help detect and block exploitation attempts.

Evidence notes

The information provided is based on data from official sources, including the CVE.org and NVD databases. The CVE record and NVD detail pages provide comprehensive information about the vulnerability, including its CVSS score, vector, and potential impacts. Additional details can be found in the mitigation or vendor reference provided by Patchstack.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54802 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54802

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54802 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54802

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.