EUVD-2026-49710
GHSA-87p3-j4x9-9hrq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Requires admin authentication (PR:H), low attack complexity, no user interaction, only confidentiality impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The SMS Alert - SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be authenticated as an administrator or a user with the 'manage_options' capability on the WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score is 4.9 (medium) with a vector indicating network attack vector, low complexity, high privileges required (admin), no user interaction, and a confidentiality impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained administrator credentials to a vulnerable WordPress site sends a crafted HTTP request to the vulnerable endpoint with a malicious SQL payload in the 'id' parameter. The injection allows the attacker to extract the entire WordPress database, including user passwords, customer data, and WooCommerce order details. |
| Remediation | Upgrade the plugin to the latest patched version (likely 3.9.8 or higher) as soon as possible. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover through authentication bypass in the SMS Alert plugin for WordPress (versions ≤3.9.7) allows unauthenti
Account-takeover privilege escalation in the SMS Alert - SMS & OTP for WooCommerce WordPress plugin (versions up to and
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-leve
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today