CVE-2026-66424

26th percentile - higher than 26% of all known CVEs

Unauthenticated Privilege Escalation vulnerability in SMS Alert Order Notifications versions up to 3.9.7. An attacker can gain higher privileges without authentication.

Risk includes takeover of administrator accounts or other privileged roles, potentially leading to full system compromise.

Update the plugin to the latest patched version. Implement additional authentication mechanisms and restrict access to the admin panel.