EUVD-2026-49711
GHSA-43w3-9r73-g656
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
PR:H due to admin access required; AV:N as network exploitable; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have administrator-level access to the WordPress installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates medium severity, but the requirement for administrator-level privileges significantly reduces real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated WordPress administrator sends a crafted HTTP request to a vulnerable endpoint, injecting malicious SQL via the 'orderby' parameter. The time-based SQLi allows the attacker to extract hashed passwords or other sensitive data from the database over multiple requests. … |
| Remediation | Upgrade to the latest patched version of the plugin from the WordPress repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenti
Account-takeover privilege escalation in the SMS Alert - SMS & OTP for WooCommerce WordPress plugin (versions up to and
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database inform
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-leve
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today