# CVE-2026-59540: Cozy Vision SMS Alert Order Notifications unauthenticated privilege escalation

Source: https://junglewise.ai/threats/cve-2026-59540-cozy-vision-sms-alert-order-notifications-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-59540 · Severity: critical · CVSS 9.8 · Published 2026-07-23

A critical security flaw exists in the SMS Alert Order Notifications plugin for WordPress, which is used to send automated SMS updates to customers. An unauthorized attacker can exploit this vulnerability to gain administrative control over the website without needing a password. This could lead to a total site takeover, theft of customer data, or complete service disruption.

Technologies: [Cozy Vision Technologies SMS Alert Order Notifications](https://junglewise.ai/threats/technologies/sms-alert-order-notifications). Vendors: [Cozy Vision Technologies](https://junglewise.ai/threats/vendors/cozy-vision-technologies).

## Quick answers

**Is CVE-2026-59540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59540 being exploited in the wild.

**How severe is CVE-2026-59540?** Critical severity, with a CVSS score of 9.8, published 23 July 2026.

**Which products and versions are affected?** Cozy Vision Technologies SMS Alert Order Notifications <= 3.9.6.

**Is there a fix for CVE-2026-59540?** A patch was published on 2026-07-23: Version 3.9.7 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59540 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59540?** Check whether you run Cozy Vision Technologies SMS Alert Order Notifications at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SMS Alert Order Notifications plugin for WordPress (versions 3.9.6 and below) contains a privilege escalation vulnerability due to incorrect privilege assignment (CWE-266). The flaw is located within the 'signup-with-mobile' completion step, where insufficient validation allows an unauthenticated remote attacker to escalate their privileges. Successful exploitation enables an attacker to gain full administrative control over the affected WordPress site. The issue is resolved in version 3.9.7.

## Affected products

- Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications <= 3.9.6

## Timeline

- 2026-07-06: disclosed: Reported by Taylsec
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: patched: Version 3.9.7 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-6-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-9-6-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [Cozy Vision SMS Alert Order Notifications privilege escalation](https://junglewise.ai/threats/cve-2026-54803-cozy-vision-sms-alert-order-notifications-privilege-escalation)
- [Cozy Vision SMS Alert Order Notifications broken authentication](https://junglewise.ai/threats/cve-2026-54802-cozy-vision-sms-alert-order-notifications-broken-authentication)