SMS Alert Order Notifications CVE-2025-26988

The target must be a WordPress site running WooCommerce with the Cozy Vision 'SMS Alert Order Notifications' plugin at version 3.7.8 or earlier and the vulnerable endpoint reachable over the network. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication and no user interaction against a default install, which would mean no special configuration is required beyond having the plugin active; however, the description does not name the specific injectable parameter or feature, and Patchstack-class WooCommerce SQLi often requires a logged-in role - so the unauthenticated, no-prerequisite reading should be confirmed against the vendor advisory. Limiting factors: exploitation is impossible without this exact plugin installed and active, impact is confined to data disclosure (C:H, I:N, A:N) so it does not by itself grant code execution or site modification, and the actual privilege level required is unconfirmed from the available data.

Signals are moderate and partly mixed. The CVSS base score of 7.5 (High) is driven entirely by confidentiality (C:H, I:N, A:N), reflecting data disclosure rather than code execution or data tampering. The provided vector states PR:N (unauthenticated) and AC:L, which would make this attractive for opportunistic scanning; however, Patchstack-reported WooCommerce plugin SQLi frequently turns out to require at least some authenticated role, and the description does not specify the entry point - so the unauthenticated classification should be verified against the Patchstack advisory before treating it as fully internet-exposable. Counterbalancing the High CVSS, EPSS is only 0.11% (30th percentile), there is no KEV listing and no public PoC identified, indicating no evidence of active or imminent mass exploitation. There is no SSVC decision data in the input. Net assessment: a credible, patch-worthy data-exposure issue, but currently a prioritize-by-exposure item rather than an emergency - escalate if the site is internet-facing and the unauthenticated vector is confirmed.

An attacker sends a crafted request containing malicious SQL to the vulnerable plugin endpoint on a WooCommerce store; because input is concatenated into a query without sanitization, the database executes the injected clause and returns sensitive rows. Using UNION-based or blind techniques the attacker iteratively dumps WordPress user password hashes and WooCommerce customer PII/order data. No public PoC was identified, but the low attack complexity (AC:L) means a working exploit would be straightforward to develop for anyone who locates the injectable parameter.