Executive brief
The SMS Alert plugin for WooCommerce, which handles order notifications and cart recovery, contains a security flaw that could allow an administrator to extract sensitive information from the website's database. By manipulating specific data sorting parameters, an attacker can run unauthorized database queries. While this requires high-level access, it could lead to the exposure of customer data or internal site configuration.
Technical details
A time-based SQL injection vulnerability exists in the SMS Alert plugin for WordPress due to insufficient escaping and lack of preparation on the 'orderby' parameter within the class-backinstock.php helper. Authenticated attackers with administrator-level privileges can exploit this by appending malicious SQL queries to existing database calls. This allows for the extraction of sensitive information from the database via inference. The issue affects all versions up to 3.9.7; a changeset (3623914) indicates remediation efforts.
Affected products
- cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery up to, and including, 3.9.7
Timeline
- 2026-07-28: advisory: NVD publication date
- 2026-07-28: disclosed: Wordfence advisory published
References
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.7/helper/class-backinstock.php
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.7/helper/class-backinstock.php
- https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.9.7/helper/class-backinstock.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3623914%40sms-alert&new=3623914%40sms-alert
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bcae549f-6a10-4b0d-a8d1-5dcc83e1f2e5?source=cve