Security Alert Summary
The miniOrange OTP Verification and SMS Notification for WooCommerce plugin contains a missing capability check on an AJAX action that allows unauthenticated attackers to enable or disable SMS notification settings for WooCommerce orders. The issue affects all versions up to and including 4.3.8 and could be used to alter SMS notification behavior without valid credentials.
CVE Details
- CVE ID: CVE-2025-14948
- Affected plugin / component: miniOrange OTP Verification and SMS Notification for WooCommerce (plugin for WordPress)
- Affected versions: All versions up to and including 4.3.8
- Published date: January 10, 2026 at 7:16:02 AM (as provided)
- Last modified date: January 10, 2026 at 7:16:02 AM (as provided)
- CVSS v3.1 base score: 5.3
- CVSS v3.1 base severity: MEDIUM
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: No authentication required;
PR:N(Privileges Required: NONE);UI:N(User Interaction: NONE) - Primary impact (CIA): Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness ID: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a missing capability/authorization check on the AJAX action named enable_wc_sms_notification. Because that action does not verify the caller’s capabilities, unauthenticated requests can invoke it and toggle SMS notification settings used for WooCommerce orders. The behavior described in the CVE indicates the plugin allows enabling or disabling SMS notifications via this AJAX endpoint without validating that the requester is an authenticated, authorized user.
Impact is limited to modification of SMS notification settings (integrity impact). The CVE does not indicate direct disclosure of confidential data or effects on availability. No additional functions, REST endpoints, or other internal routines are named beyond the enable_wc_sms_notification AJAX action in the provided description.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff (store managers or fulfillment staff), and external contractors or contributors. An unauthenticated attacker could toggle the plugin’s SMS notification setting for orders. Practical consequences include:
- Order SMS notifications being disabled, causing staff or customers to miss timely order status updates.
- Order SMS notifications being enabled unexpectedly, which could lead to unexpected outbound messages and operational confusion.
- An increased risk of social engineering or operational disruption if notification behavior is changed without authorization; while the CVSS data indicates confidentiality impact is NONE (no direct data disclosure), altering notification channels can assist broader phishing or social-engineering campaigns in some environments.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE indicates affected versions up to and including 4.3.8.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected changes to plugin settings or repeated requests to AJAX endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/miniorange-sms-order-notification-otp-verification/tags/4.3.8/notifications/wcsmsnotification/handler/class-woocommercenotifications.php#L138
- https://plugins.trac.wordpress.org/browser/miniorange-sms-order-notification-otp-verification?rev=3423647
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f84ddc83-2079-45b9-8354-51094581b1f8?source=cve
