WooCommerce SMS Plugin Unauthenticated Password Reset Vulnerability

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SMS Alert plugin for WooCommerce contains a critical privilege escalation vulnerability (CVE-2026-11387, CVSS 9.8) that allows unauthenticated attackers to reset passwords for any user account, including administrators. The vulnerability stems from insufficient identity validation before processing password reset requests, enabling complete account takeover. This affects all versions up to 3.9.5 of the plugin, putting thousands of WooCommerce stores at risk of unauthorized access. The attack requires no prior authentication or user interaction, making it trivially exploitable and immediately actionable for threat actors seeking initial access to WordPress environments.

Casky's 283 matching security skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious indicators including: unauthenticated requests to password reset endpoints lacking proper CSRF tokens or user identity verification, rapid sequential password changes on administrative accounts without corresponding login activity, and API calls manipulating user account data without valid session tokens. The platform's skill mapping would surface detection opportunities for monitoring account modification logs for changes originating from unauthenticated sources, flagging requests that bypass normal authentication workflows, and correlating password resets with subsequent unauthorized access attempts—enabling security teams to catch exploitation attempts before attackers achieve persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11387.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

analyzing-cloud-storage-access-patterns

cloud security · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-11387

Casky has 283 skills that investigate the attack patterns behind CVE-2026-11387. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn