WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.10 - Authenticated (Contributor+) Insecure Direct Object Reference to WooCommerce Customer Phone Number Disclosure via 'post' and 'id' Parameters
- ID
- WPSEC-2026-2241
- Plugin
- WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS (wp-sms)
- Affected
- all versions before 7.2.11
- Remediation
- Update to 7.2.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WSMS (formerly WP SMS) plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'post' and 'id' URL parameters in all versions up to, and including, 7.2.10. This is due to the admin script enqueue routine, which runs on every wp-admin page, taking a WooCommerce order ID from those parameters, looking up that order's customer phone number and printing it into the page's JavaScript without checking that the user can edit the order. This makes it possible for authenticated attackers with contributor-level access and above to read the phone number of any WooCommerce customer by changing the order ID in the URL of any admin page they can load.
References
- https://wpsec.com/vuln/WPSEC-2026-2241/
- https://plugins.svn.wordpress.org/wp-sms/tags/7.2.11/
- https://wordpress.org/plugins/wp-sms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS