{"vulnerability": "CVE-2026-11387", "sightings": [{"uuid": "f8cc3fc6-a243-4a35-8871-e28c02c628ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11387", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpl6rdwfr22q", "content": "\u0423\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: CVE-2026-11387 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 SMS Alert \u0434\u043b\u044f WooCommerce\n\n\n\nhttps://kripta.biz/posts/F7FDF774-D82B-4EED-94DE-9DB9FBD2DBED", "creation_timestamp": "2026-07-01T09:19:02.592492Z"}, {"uuid": "f7de6d23-8280-47d4-9064-9c0bd66ae0db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-11387", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116844254575740206", "content": "CVE-2026-11387 | SMS Alert \u2013 SMS & OTP for WooCommerce <=3.9.5 has a CRITICAL auth flaw (CVSS 9.8): Unauth attackers can take over any WP account if OTP resets & phone numbers are enabled. Disable OTP resets ASAP. https://radar.offseq.com/threat/cve-2026-11387-cwe-287-improper-authentication-in--cb792a6868247a84 #OffSeq #WordPress #Infosec", "creation_timestamp": "2026-07-01T10:30:34.645846Z"}, {"uuid": "b571aafa-f464-47b6-b2c4-3bf9748b63e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-11387", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mplcrcszoe25", "content": "CRITICAL (CVSS 9.8): cozyvision1 SMS Alert \u2013 SMS & OTP for WooCommerce <=3.9.5 lets unauth attackers hijack accounts via OTP flaw. Disable OTP resets or remove phone numbers until patched. https://radar.offseq.com/threat/cve-2026-11387-cwe-287-improper-authentication-in--cb792a6868247a84 #OffSeq ...", "creation_timestamp": "2026-07-01T10:30:36.578111Z"}, {"uuid": "733f7773-b93e-47d1-885a-609652e43364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11387", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgltzcv426", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-11387 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 SMS Alert \u0434\u043b\u044f WooCommerce: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/86C9D953-6481-4ADE-A6D1-384AF0E54E5A", "creation_timestamp": "2026-07-01T11:39:07.910135Z"}, {"uuid": "9eed3fbb-9d68-49fb-b9f0-b7b6114a872f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11387", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpljs5udtb26", "content": "CVE-2026-11387 - SMS Alert\nCVE ID : CVE-2026-11387\n \n Published : July 1, 2026, 7:53 a.m. | 3\u00a0hours, 53\u00a0minutes ago\n \n Description : The SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege...", "creation_timestamp": "2026-07-01T12:36:20.225679Z"}]}