Privilege Escalation in WooCommerce Plugin by WordPress

CVE-2025-3876

What is CVE-2025-3876?

The SMS Alert Order Notifications – WooCommerce plugin for WordPress exhibits a vulnerability where insufficient user OTP validation occurs during the handleWpLoginCreateUserAction() process. This flaw allows authenticated attackers with a Subscriber-level account or higher to exploit the system, impersonating any user by merely providing their username or email. Consequently, attackers can escalate their privileges and gain administrative access, which poses a severe risk to the integrity and security of the affected WordPress environments.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References