{"id":19693,"date":"2025-04-08T09:19:16","date_gmt":"2025-04-08T09:19:16","guid":{"rendered":""},"modified":"2025-05-11T12:17:20","modified_gmt":"2025-05-11T12:17:20","slug":"cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/","title":{"rendered":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce"},"content":{"rendered":"<p class=\"\" data-start=\"108\" data-end=\"133\"><strong data-start=\"108\" data-end=\"133\">Vulnerability Summary<\/strong><\/p>\n<ul data-start=\"135\" data-end=\"380\">\n<li class=\"\" data-start=\"135\" data-end=\"165\">\n<p class=\"\" data-start=\"137\" data-end=\"165\"><strong data-start=\"137\" data-end=\"148\">CVE ID:<\/strong> CVE-2024-13553<\/p>\n<\/li>\n<li class=\"\" data-start=\"166\" data-end=\"214\">\n<p class=\"\" data-start=\"168\" data-end=\"214\"><strong data-start=\"168\" data-end=\"181\">Severity:<\/strong> Critical (CVSS 3.1 Score: 9.8)<\/p>\n<\/li>\n<li class=\"\" data-start=\"215\" data-end=\"245\">\n<p class=\"\" data-start=\"217\" data-end=\"245\"><strong data-start=\"217\" data-end=\"235\">Attack Vector:<\/strong> Network<\/p>\n<\/li>\n<li class=\"\" data-start=\"246\" data-end=\"279\">\n<p class=\"\" data-start=\"248\" data-end=\"279\"><strong data-start=\"248\" data-end=\"272\">Privileges Required:<\/strong> None<\/p>\n<\/li>\n<li class=\"\" data-start=\"280\" data-end=\"310\">\n<p class=\"\" data-start=\"282\" data-end=\"310\"><strong data-start=\"282\" data-end=\"303\">User Interaction:<\/strong> None<\/p>\n<\/li>\n<li class=\"\" data-start=\"311\" data-end=\"380\">\n<p class=\"\" data-start=\"313\" data-end=\"380\"><strong data-start=\"313\" data-end=\"324\">Impact:<\/strong> Full account takeover, including administrator <a class=\"wpil_keyword_link\" href=\"https:\/\/www.ameeba.com\"   title=\"access\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"24326\">access<\/a><\/p>\n<\/li>\n<\/ul>\n<p class=\"\" data-start=\"382\" data-end=\"403\"><strong data-start=\"382\" data-end=\"403\">Affected Products<\/strong><\/p>\n<div class=\"pointer-events-none relative left-[50%] flex w-[100cqw] translate-x-[-50%] justify-center *:pointer-events-auto\">\n<div class=\"tableContainer horzScrollShadows\">\n<table class=\"min-w-full\" data-start=\"405\" data-end=\"549\">\n<thead data-start=\"405\" data-end=\"434\">\n<tr data-start=\"405\" data-end=\"434\">\n<th data-start=\"405\" data-end=\"413\">Product<\/th>\n<th data-start=\"413\" data-end=\"434\">Affected Versions<\/th>\n<\/tr>\n<\/thead>\n<tbody data-start=\"466\" data-end=\"549\">\n<tr data-start=\"466\" data-end=\"549\">\n<td class=\"max-w-[calc(var(--thread-content-max-width)*2\/3)] min-w-[calc(var(--thread-content-max-width)\/3)]\" data-start=\"466\" data-end=\"529\">SMS Alert Order Notifications \u2013 WooCommerce (<a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6532-cross-site-request-forgery-vulnerability-in-wp-blogs-planetarium-wordpress-plugin-vulnerability-summary\/\"  data-wpil-monitor-id=\"25041\">WordPress plugin<\/a>)<\/td>\n<td class=\"max-w-[calc(var(--thread-content-max-width)*2\/3)]\" data-start=\"529\" data-end=\"549\">Versions \u2264 3.7.9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p class=\"\" data-start=\"551\" data-end=\"576\"><strong data-start=\"551\" data-end=\"576\">How the Exploit Works<\/strong><\/p>\n<p class=\"\" data-start=\"578\" data-end=\"773\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2005-critical-vulnerability-in-the-wordpress-plugin-front-end-users-feup\/\"  data-wpil-monitor-id=\"26015\">vulnerability stems from the plugin&#8217;s<\/a> reliance on the <code data-start=\"58\" data-end=\"64\">Host<\/code> header to determine if it&#8217;s operating in a &#8220;playground&#8221; environment.<\/span> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">In such environments, the plugin sets the One-Time Password (OTP) code to a static value of &#8220;1234&#8221; for testing purposes.<\/span> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">An unauthenticated <a href=\"https:\/\/www.ameeba.com\/blog\/unmasking-tcesb-malware-a-deep-analysis-of-active-attacks-exploiting-eset-security-scanner\/\"  data-wpil-monitor-id=\"27974\">attacker can exploit<\/a> this by spoofing the <code data-start=\"61\" data-end=\"67\">Host<\/code> header in HTTP requests, tricking the plugin into treating the request as if it&#8217;s from a playground environment.<\/span> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">This allows the attacker to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-40250-critical-authentication-bypass-vulnerability-in-web-applications\/\"  data-wpil-monitor-id=\"26471\">bypass authentication<\/a> mechanisms and gain access to any user account, including those with administrative privileges.<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-13553?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">GitHub<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+2<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">NVD<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+2<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">CVE<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+2<\/span><\/span><\/span><\/a><\/span><span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2024-13553&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">CVE<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">NVD<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><\/span><\/a><\/span><\/p>\n<p class=\"\" data-start=\"775\" data-end=\"802\"><strong data-start=\"775\" data-end=\"802\">Conceptual Example Code<\/strong><\/p>\n<p class=\"\" data-start=\"804\" data-end=\"885\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">An <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-3200-unauthenticated-remote-attacker-exploiting-insecure-tls-protocols\/\"  data-wpil-monitor-id=\"41811\">attacker might craft a request as follows to exploit<\/a> the vulnerability:\u200b<\/p>\n<div class=\"contain-inline-size rounded-md border-[0.5px] border-token-border-medium relative bg-token-sidebar-surface-primary\">\n<div class=\"overflow-y-auto p-4\" dir=\"ltr\"><code class=\"whitespace-pre! language-http\">POST \/wp-admin\/admin-ajax.php?action=login_with_otp HTTP\/1.1<br \/>\nHost: playground.example.com<br \/>\nContent-Type: application\/x-www-form-urlencoded<\/p>\n<p>username=admin&amp;otp=1234<\/code><\/div>\n<\/div>\n<p class=\"\" data-start=\"1104\" data-end=\"1185\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">By setting the <code data-start=\"15\" data-end=\"21\">Host<\/code> header to a value recognized as a playground environment and providing the static OTP, the attacker can gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26733-unauthorized-access-vulnerability-in-shinetheme-traveler-software\/\"  data-wpil-monitor-id=\"34237\">unauthorized access<\/a>.<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2024-13553&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">CVE<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">GitHub<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><\/span><\/a><\/span><\/p>\n<p class=\"\" data-start=\"1187\" data-end=\"1206\"><strong data-start=\"1187\" data-end=\"1206\">Potential Risks<\/strong><\/p>\n<ul data-start=\"1208\" data-end=\"1559\">\n<li class=\"\" data-start=\"1208\" data-end=\"1295\">\n<p class=\"\" data-start=\"1210\" data-end=\"1295\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Complete <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-3607-privilege-escalation-via-account-takeover-in-wordpress-frontend-login-and-registration-blocks-plugin\/\"  data-wpil-monitor-id=\"41810\">takeover of WordPress<\/a> sites\u200b<\/p>\n<\/li>\n<li class=\"\" data-start=\"1296\" data-end=\"1383\">\n<p class=\"\" data-start=\"1298\" data-end=\"1383\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Unauthorized access to sensitive customer data<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/vuldb.com\/?id.302600=&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">VulDB<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">GitHub<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><\/span><\/a><\/span><\/p>\n<\/li>\n<li class=\"\" data-start=\"1384\" data-end=\"1471\">\n<p class=\"\" data-start=\"1386\" data-end=\"1471\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Installation of malicious plugins or themes<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2024-13553&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between overflow-hidden\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">CVE<\/span><\/span><\/span><\/a><\/span><\/p>\n<\/li>\n<li class=\"\" data-start=\"1472\" data-end=\"1559\">\n<p class=\"\" data-start=\"1474\" data-end=\"1559\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Defacement or disruption of e-commerce operations<\/span>\u200b<\/p>\n<\/li>\n<\/ul>\n<p class=\"\" data-start=\"1561\" data-end=\"1591\"><strong data-start=\"1561\" data-end=\"1591\">Mitigation Recommendations<\/strong><\/p>\n<ul data-start=\"1593\" data-end=\"2159\">\n<li class=\"\" data-start=\"1593\" data-end=\"1703\">\n<p class=\"\" data-start=\"1595\" data-end=\"1703\"><strong data-start=\"1595\" data-end=\"1617\">Update the Plugin:<\/strong> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Ensure the SMS Alert Order Notifications plugin is updated to the latest <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-3248-critical-code-injection-vulnerability-in-langflow-versions-prior-to-1-3-0\/\"  data-wpil-monitor-id=\"30429\">version where this vulnerability<\/a> is patched.<\/span>\u200b<span class=\"\" data-state=\"closed\"><span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/access.redhat.com\/security\/cve\/cve-2024-13553?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">CVE<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+4<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">Red Hat Customer Portal<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+4<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">GitHub<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+4<\/span><\/span><\/span><\/a><\/span><\/span><\/p>\n<\/li>\n<li class=\"\" data-start=\"1704\" data-end=\"1837\">\n<p class=\"\" data-start=\"1706\" data-end=\"1837\"><strong data-start=\"1706\" data-end=\"1751\">Implement Web Application Firewall (WAF):<\/strong> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Use a WAF to detect and block malicious requests, including those with spoofed <code data-start=\"79\" data-end=\"85\">Host<\/code> headers.<\/span>\u200b<\/p>\n<\/li>\n<li class=\"\" data-start=\"1838\" data-end=\"1946\">\n<p class=\"\" data-start=\"1840\" data-end=\"1946\"><strong data-start=\"1840\" data-end=\"1860\">Restrict Access:<\/strong> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Limit <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28232-unauthenticated-access-to-admin-panel-in-jmbroadcast-jmb0150-firmware-v1-0\/\"  data-wpil-monitor-id=\"37638\">access to the WordPress admin panel<\/a> and sensitive endpoints to trusted IP addresses.<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-13553?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">NVD<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><span class=\"flex h-4 w-full items-center justify-between absolute\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">Red Hat Customer Portal<\/span><span class=\"ms-1 -me-1 flex h-full items-center rounded-full px-1 text-[#8F8F8F]\">+1<\/span><\/span><\/span><\/a><\/span><\/p>\n<\/li>\n<li class=\"\" data-start=\"1947\" data-end=\"2052\">\n<p class=\"\" data-start=\"1949\" data-end=\"2052\"><strong data-start=\"1949\" data-end=\"1966\">Monitor Logs:<\/strong> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Regularly review <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-23186-sap-netweaver-application-server-abap-vulnerability-exposing-remote-credentials\/\"  data-wpil-monitor-id=\"31314\">server and application<\/a> logs for suspicious activities, such as repeated login attempts or unusual <code data-start=\"115\" data-end=\"121\">Host<\/code> headers.<\/span>\u200b<\/p>\n<\/li>\n<li class=\"\" data-start=\"2053\" data-end=\"2159\">\n<p class=\"\" data-start=\"2055\" data-end=\"2159\"><strong data-start=\"2055\" data-end=\"2073\">Educate Users:<\/strong> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Inform users about the importance of strong <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-55210-bypassing-multi-factor-authentication-in-totvs-framework\/\"  data-wpil-monitor-id=\"31757\">authentication methods and encourage the use of multi-factor<\/a> authentication (MFA).<\/span>\u200b<\/p>\n<\/li>\n<\/ul>\n<p class=\"\" data-start=\"2161\" data-end=\"2175\"><strong data-start=\"2161\" data-end=\"2175\">Conclusion<\/strong><\/p>\n<p class=\"\" data-start=\"2177\" data-end=\"2342\"><span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">CVE-2024-13553 is a critical vulnerability that allows unauthenticated attackers to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6140-arbitrary-file-upload-vulnerability-in-essential-real-estate-wordpress-plugin\/\"  data-wpil-monitor-id=\"24584\">bypass authentication mechanisms in the SMS Alert Order Notifications plugin<\/a> for WooCommerce.<\/span> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\"><a href=\"https:\/\/www.ameeba.com\/blog\/microsoft-s-recent-patch-a-detailed-analysis-of-the-126-flaws-and-the-actively-exploited-windows-clfs-vulnerability\/\"  data-wpil-monitor-id=\"26136\">Exploiting this flaw<\/a> can lead to full site compromise, posing significant risks to e-commerce operations.<\/span> <span class=\"relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out\">Immediate action is required to update the plugin and implement recommended <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-52073-critical-buffer-overflow-exploit-in-network-security-systems\/\"  data-wpil-monitor-id=\"25330\">security measures to protect against potential exploitation<\/a>.<\/span>\u200b<span class=\"ms-1 inline-flex max-w-full items-center relative top-[-0.094rem] animate-[show_150ms_ease-in]\"><a class=\"flex h-6 overflow-hidden rounded-xl px-2.5 text-[0.5625em] font-medium !text-token-text-secondary !bg-[#F4F4F4] dark:!bg-[#303030] transition-colors duration-150 ease-in-out\" href=\"https:\/\/github.com\/advisories\/GHSA-2qjj-4522-pjgp?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\"><span class=\"relative start-0 bottom-0 flex h-full w-full items-center\"><span class=\"flex h-4 w-full items-center justify-between overflow-hidden\"><span class=\"max-w-full grow truncate overflow-hidden text-center\">GitHub<\/span><\/span><\/span><\/a><\/span><\/p>\n<p class=\"\" data-start=\"2344\" data-end=\"2358\"><strong data-start=\"2344\" data-end=\"2358\">References<\/strong><\/p>\n<ul data-start=\"2360\" data-end=\"2848\">\n<li class=\"\" data-start=\"2360\" data-end=\"2435\">\n<p class=\"\" data-start=\"2362\" data-end=\"2435\"><a class=\"\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-13553\" target=\"_new\" rel=\"noopener\" data-start=\"2362\" data-end=\"2433\">NVD \u2013 CVE-2024-13553<\/a><\/p>\n<\/li>\n<li class=\"\" data-start=\"2436\" data-end=\"2556\">\n<p class=\"\" data-start=\"2438\" data-end=\"2556\"><a target=\"_new\" rel=\"noopener\" data-start=\"2438\" data-end=\"2554\">Wordfence Advisory<\/a><\/p>\n<\/li>\n<li class=\"\" data-start=\"2557\" data-end=\"2638\">\n<p class=\"\" data-start=\"2559\" data-end=\"2638\"><a class=\"\" href=\"https:\/\/github.com\/advisories\/GHSA-2qjj-4522-pjgp\" target=\"_new\" rel=\"noopener\" data-start=\"2559\" data-end=\"2636\">GitHub Security Advisory<\/a><\/p>\n<\/li>\n<li class=\"\" data-start=\"2639\" data-end=\"2743\">\n<p class=\"\" data-start=\"2641\" data-end=\"2743\"><a target=\"_new\" rel=\"noopener\" data-start=\"2641\" data-end=\"2741\">WordPress Plugin Changeset 3227241<\/a><\/p>\n<\/li>\n<li class=\"\" data-start=\"2744\" data-end=\"2848\">\n<p class=\"\" data-start=\"2746\" data-end=\"2848\"><a target=\"_new\" rel=\"noopener\" data-start=\"2746\" data-end=\"2846\">WordPress Plugin Changeset 3248017<\/a><\/p>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin&#8217;s reliance on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[79],"product":[],"attack_vector":[75],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-19693","post","type-post","status-publish","format-standard","hentry","category-uncategorized","vendor-github","attack_vector-authentication-bypass"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin&#039;s reliance on\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Ameeba\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Ameeba Blog - Your Guide to a Safer Digital World.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin&#039;s reliance on\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-04-08T09:19:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-05-11T12:17:20+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin&#039;s reliance on\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#blogposting\",\"name\":\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog\",\"headline\":\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce\",\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#articleImage\"},\"datePublished\":\"2025-04-08T09:19:16+00:00\",\"dateModified\":\"2025-05-11T12:17:20+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#webpage\"},\"articleSection\":\"Uncategorized, Github, Authentication Bypass\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#listItem\",\"name\":\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#listItem\",\"position\":3,\"name\":\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/category\\\/uncategorized\\\/#listItem\",\"name\":\"Uncategorized\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/image-5.png\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/\",\"name\":\"Ameeba\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Ameeba\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/\",\"name\":\"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog\",\"description\":\"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \\u2013 WooCommerce (WordPress plugin) Versions \\u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin's reliance on\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/author\\\/admin\\\/#author\"},\"datePublished\":\"2025-04-08T09:19:16+00:00\",\"dateModified\":\"2025-05-11T12:17:20+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/\",\"name\":\"Ameeba Blog\",\"description\":\"Your Guide to a Safer Digital World.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ameeba.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin's reliance on","canonical_url":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#blogposting","name":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog","headline":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce","author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/#articleImage"},"datePublished":"2025-04-08T09:19:16+00:00","dateModified":"2025-05-11T12:17:20+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#webpage"},"articleSection":"Uncategorized, Github, Authentication Bypass"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ameeba.com\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","position":2,"name":"Uncategorized","item":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#listItem","name":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#listItem","position":3,"name":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/#listItem","name":"Uncategorized"}}]},{"@type":"Organization","@id":"https:\/\/www.ameeba.com\/blog\/#organization","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","url":"https:\/\/www.ameeba.com\/blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#organizationLogo"},"image":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author","url":"https:\/\/www.ameeba.com\/blog\/author\/admin\/","name":"Ameeba","image":{"@type":"ImageObject","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/ead225eeac23a6207666b4137a84523c6b550501a7ee49c81559ebd727825560?s=96&d=mm&r=g","width":96,"height":96,"caption":"Ameeba"}},{"@type":"WebPage","@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#webpage","url":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/","name":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog","description":"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin's reliance on","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ameeba.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"creator":{"@id":"https:\/\/www.ameeba.com\/blog\/author\/admin\/#author"},"datePublished":"2025-04-08T09:19:16+00:00","dateModified":"2025-05-11T12:17:20+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ameeba.com\/blog\/#website","url":"https:\/\/www.ameeba.com\/blog\/","name":"Ameeba Blog","description":"Your Guide to a Safer Digital World.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ameeba.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Ameeba Blog - Your Guide to a Safer Digital World.","og:type":"article","og:title":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog","og:description":"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin's reliance on","og:url":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/","og:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","og:image:secure_url":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png","article:published_time":"2025-04-08T09:19:16+00:00","article:modified_time":"2025-05-11T12:17:20+00:00","twitter:card":"summary_large_image","twitter:title":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce - Ameeba Blog","twitter:description":"Vulnerability Summary CVE ID: CVE-2024-13553 Severity: Critical (CVSS 3.1 Score: 9.8) Attack Vector: Network Privileges Required: None User Interaction: None Impact: Full account takeover, including administrator access Affected Products Product Affected Versions SMS Alert Order Notifications \u2013 WooCommerce (WordPress plugin) Versions \u2264 3.7.9 How the Exploit Works The vulnerability stems from the plugin's reliance on","twitter:image":"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/02\/image-5.png"},"aioseo_meta_data":{"post_id":"19693","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2025-04-08 09:28:18","updated":"2026-04-05 17:38:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/\" title=\"Uncategorized\">Uncategorized<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ameeba.com\/blog\/"},{"label":"Uncategorized","link":"https:\/\/www.ameeba.com\/blog\/category\/uncategorized\/"},{"label":"CVE-2024-13553: Critical Authentication Bypass in SMS Alert Order Notifications Plugin for WooCommerce","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-13553-critical-authentication-bypass-in-sms-alert-order-notifications-plugin-for-woocommerce\/"}],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/19693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=19693"}],"version-history":[{"count":0,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/19693\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=19693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=19693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=19693"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=19693"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=19693"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=19693"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=19693"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=19693"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=19693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}