PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-95594 Cozy Vision Technologies Pvt. Ltd. CVE debrief

CVE-2026-95594 is a Privilege Escalation vulnerability in the WordPress SMS Alert Order Notifications plugin versions up to 4.0.0. The issue, caused by incorrect privilege assignment, allows for potential privilege escalation. This CVE was published on 2026-10-06T08:35:08.065Z and was last modified on 2026-10-12T14:07:16.423Z. Defenders managing WordPress installations with the SMS Alert Order Notifications plugin should assess exposure and prioritize verification and potential updates. The vulnerability has a CVSS score of 8.1 and a HIGH severity rating.

Vendor
Cozy Vision Technologies Pvt. Ltd.
Product
SMS Alert Order Notifications
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-06
Original CVE updated
2026-10-12
Advisory published
2026-10-06
Advisory updated
2026-10-12

Who should care

Defenders managing WordPress installations with the SMS Alert Order Notifications plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-95594 is a Privilege Escalation vulnerability in the WordPress SMS Alert Order Notifications plugin versions up to 4.0.0. Defenders managing WordPress installations with this plugin should verify exposure, assess the need for updates or compensating controls, and prioritize remediation based on the CVSS score of 8.1 and the HIGH severity rating.

  • Verification of plugin version and potential updates is necessary to prevent exploitation.
  • Defenders should assess the need for compensating controls to mitigate potential privilege escalation.

Technical summary

The SMS Alert Order Notifications plugin for WordPress, versions up to 4.0.0, contains a Privilege Escalation vulnerability due to incorrect privilege assignment. This allows for potential privilege escalation. The vulnerability has been assigned a CVSS score of 8.1 and a HIGH severity rating. Defenders should prioritize verifying exposure of WordPress installations using SMS Alert Order Notifications plugin versions up to 4.0.0 and assess the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using SMS Alert Order Notifications plugin versions up to 4.0.0 and assess the need for updates or compensating controls.

Recommended defensive actions

  • Verify WordPress installations for SMS Alert Order Notifications plugin version 4.0.0 or earlier
  • Assess the need for updates to plugin version 4.0.1 or later
  • Consider implementing compensating controls for privilege escalation

Evidence notes

The CVE record and source item provide details on the vulnerability. However, additional information on potential exploitation or specific impacts is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-95594 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-95594

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-95594 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-95594

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.