Privilege Escalation in WooCommerce Plugin by WordPress

CVE-2025-3876

What is CVE-2025-3876?

The SMS Alert Order Notifications – WooCommerce plugin for WordPress exhibits a vulnerability where insufficient user OTP validation occurs during the handleWpLoginCreateUserAction() process. This flaw allows authenticated attackers with a Subscriber-level account or higher to exploit the system, impersonating any user by merely providing their username or email. Consequently, attackers can escalate their privileges and gain administrative access, which poses a severe risk to the integrity and security of the affected WordPress environments.

References