CVE-2026-15671mediumCWE-89

CVE-2026-15671: fallo de gravedad media en cozyvision1 SMS Alert – SMS & OTP for…

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

Publicada el

Seguir esta CVE+ Monitorear SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.9epss 0.5%
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Productos afectados
cozyvision1 · SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
CVEs relacionadas — cozyvision1 SMS Alert – SMS & OTP for…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-11387CRITICALSMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password ResetEPSS 2.2%CVE-2026-15014CRITICALSMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' ParameterEPSS 0.9%CVE-2024-13553CRITICALSMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege EscalationEPSS 0.5%CVE-2024-11725HIGHSMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%CVE-2026-15673MEDIUMSMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' SettingsEPSS 0.5%CVE-2025-3876HIGHSMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction FunctionEPSS 0.5%