CVE-2024-11725 affects the SMS Alert Order Notifications – WooCommerce plugin for WordPress, specifically versions up to and including 3.7.6, allowing authenticated subscriber-level users to modify arbitrary WordPress options due to a missing capability check. This high-severity vulnerability (CVSS 8.8) enables privilege escalation by allowing attackers to change the default registration role to administrator, provided the woocommerce-warranty plugin is also installed. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.7.7CPE matchmatch criteria | cpe:2.3:a:cozyvision:sms_alert_order_notifications:*:*:*:*:free:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.