What is the CVSS score of CVE-2025-26988?

CVE-2025-26988 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of SMS Alert Order Notifications are affected by CVE-2025-26988?

The Cozy Vision SMS Alert Order Notifications plugin for WooCommerce (all versions through 3.7.8) contains a database security flaw that allows unauthenticated attackers to access sensitive customer…

How to fix or mitigate CVE-2025-26988?

Within 24 hours: Audit all WooCommerce instances to identify installations of Cozy Vision SMS Alert plugin versions 3.7.8 and earlier; review database and web application logs for SQL injection attack attempts. Within 7 days: If operationally feasible, deactivate and remove the plugin from all affected instances; if business-critical, implement WAF rules to block SQL injection patterns and restrict HTTP access to plugin endpoints via IP allowlist. Within 30 days: Monitor Patchstack and official Cozy Vision releases for security patches; prepare immediate deployment plan for patched version or identify and deploy alternative plugin solution.

SMS Alert Order Notifications CVE-2025-26988

HIGH

SQL Injection (CWE-89)

2025-03-03 audit@patchstack.com

WordPress SQLi Sms Alert Order Notifications

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Matches the network-reachable, low-complexity SQLi with high confidentiality and no integrity/availability impact; PR:N retained from the source vector but flagged as unverified for the entry point.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 17:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 17:30 vuln.today

v2 (cvss_changed)

Severity Changed

Jun 26, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Jun 26, 2026 - 17:22 NVD

9.3 (CRITICAL) 7.5 (HIGH)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

HIGH CRITICAL

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.5 (HIGH) 9.3 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.5

DescriptionNVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications - WooCommerce allows SQL Injection. This issue affects SMS Alert Order Notifications - WooCommerce: from n/a through 3.7.8.

AnalysisAI

SQL injection in the Cozy Vision 'SMS Alert Order Notifications - WooCommerce' WordPress plugin (all versions up to and including 3.7.8) lets remote attackers inject crafted SQL into backend database queries, enabling extraction of arbitrary data such as customer records, order details, and WordPress credential hashes. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with high confidentiality impact and no integrity or availability impact, consistent with a read-oriented (e.g. UNION/blind) injection. No public exploit was identified at time of analysis and EPSS is low (0.11%, 30th percentile), but the flaw was reported by Patchstack, a credible WordPress vulnerability research source.

Technical ContextAI

The affected component is a WooCommerce add-on (CPE cpe:2.3:a:cozyvision:sms_alert_order_notifications) that sends SMS notifications for store orders, running atop WordPress/WooCommerce and MySQL/MariaDB. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL statement without parameterized queries or proper sanitization/escaping (e.g. failure to use WordPress's $wpdb->prepare()). In WordPress plugins this class of bug commonly arises from order-lookup, reporting, or AJAX/REST handlers that pass request parameters straight into a query. Because WordPress stores all site data - including users, password hashes, and WooCommerce customer/order PII - in a shared database, a single injectable query can expose the entire schema.

RemediationAI

No fixed version is named in the available data, so apply the most specific control that holds: upgrade to the latest plugin release above 3.7.8 once Cozy Vision publishes a patched build, confirming the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-woocommerce-plugin-3-7-8-sql-injection-vulnerability?_s_id=cve) before deploying - do not assume a version number. If no patch is yet available, deactivate and remove the 'SMS Alert Order Notifications' plugin (trade-off: order SMS notifications stop), or place a WAF/virtual patch in front of the site to block SQL-injection patterns on the plugin's request parameters and endpoints (trade-off: pattern-based rules can be bypassed and may cause false positives on legitimate order data). As defense-in-depth with real impact, restrict the database account used by WordPress to the minimum required privileges and ensure it cannot read tables outside the site schema, and rotate WordPress/WooCommerce credentials and API keys if you suspect the database was already queried.