CVE-2024-13553 is a critical (CVSS 9.8) account takeover in the SMS Alert Order Notifications plugin for WooCommerce, in versions up to and including 3.7.9. It trusts the Host header to decide the OTP, so attackers can log in as any user. Update past 3.7.9 or remove it.
What's affected
- SMS Alert Order Notifications for WooCommerce, all versions up to and including 3.7.9.
The record does not name a fixed version, but it links two code changesets. Check the plugin page for a release newer than 3.7.9.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i sms
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the plugin to a release newer than 3.7.9.
- If your store does not use SMS login, deactivate the plugin or switch off OTP login.
- Review administrator accounts and recent logins.
- Look up CVE-2024-13553 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The plugin used the Host header to decide whether it was running in a playground environment. In that mode the one time code is fixed. Because a visitor controls the Host header, they can claim to be in that mode and the check no longer proves anything.
The pattern is worth remembering: any security decision that depends on a request header the client sets is a decision the client makes. Test and demo shortcuts should be removed from production builds or gated by server side configuration.
This CVE is an authentication bypass (CWE-288, CWE-306, Authentication Bypass Using an Alternate Path or Channel and Missing Authentication for Critical Function). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Authentication bypass bugs skip the one question a login system exists to answer: who is this person. When the check on the identity is weak or missing, the rest of the access control model stops mattering, because the attacker simply arrives as someone who is allowed in.
For a content site or store the worst case is an administrator session. An admin can install plugins, edit files and create accounts, so a login bypass is often one step from full site control. Fixing it means verifying identity on the server, every time, against something the visitor cannot choose.
Quick check
Why does the Host header matter?
A visitor can set it freely. The plugin trusted it to select a test mode.
Which accounts are exposed?
The record says any user, including administrators.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
