# CVE-2026-11387: CozyVision SMS Alert privilege escalation via account takeover

Source: https://junglewise.ai/threats/cve-2026-11387-cozyvision-sms-alert-privilege-escalation-via-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-11387 · Severity: critical · CVSS 9.8 · Published 2026-07-01

A security flaw in a popular WordPress plugin used for sending SMS notifications and one-time passwords (OTP) allows attackers to take over any user account, including administrators. By exploiting a weakness in how the plugin verifies identities during password resets, an attacker can change a user's email address and then reset their password to gain full control of the website. This could lead to total site compromise, data theft, and loss of service.

Technologies: [CozyVision SMS Alert](https://junglewise.ai/threats/technologies/sms-alert). Vendors: [CozyVision](https://junglewise.ai/threats/vendors/cozyvision).

## Quick answers

**Is CVE-2026-11387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11387 being exploited in the wild.

**How severe is CVE-2026-11387?** Critical severity, with a CVSS score of 9.8, published 1 July 2026.

**Which products and versions are affected?** CozyVision SMS Alert <= 3.9.5.

**Is there a fix for CVE-2026-11387?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11387 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11387?** Check whether you run CozyVision SMS Alert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SMS Alert plugin for WordPress (versions up to 3.9.5) contains an improper authentication vulnerability (CWE-287) that allows for privilege escalation and account takeover. The root cause is a failure to properly validate a user's identity before allowing updates to account details, such as email addresses. An unauthenticated remote attacker can exploit this by changing an arbitrary user's email address and subsequently using the standard WordPress password reset flow to gain access. This vulnerability specifically affects sites where OTP verification for password resets is enabled and the target user (e.g., an administrator) has a phone number configured for OTP. A patch was introduced in version 3.9.6.

## Affected products

- CozyVision SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.5

## Timeline

- 2026-07-01: disclosed
- 2026-07-01: advisory

## References

- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-ultimatemember.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-ultimatemember.php)
- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-ultimatemember.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-ultimatemember.php)
- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php)
- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php)
- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/forms/class-wpresetpassword.php)
- [https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/smsalert_form_handler.php](https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.5/handler/smsalert_form_handler.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3587983%40sms-alert&new=3587983%40sms-alert&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3587983%40sms-alert&new=3587983%40sms-alert&sfp_email=&sfph_mail=)

## Related threats

- [CozyVision SMS Alert for WooCommerce SQL injection in settings](https://junglewise.ai/threats/cve-2026-15673-cozyvision-sms-alert-for-woocommerce-sql-injection-in-settings)
- [CozyVision SMS Alert SQL injection in id parameter](https://junglewise.ai/threats/cve-2026-15671-cozyvision-sms-alert-sql-injection-in-id-parameter)