SMS Alert <= 3.9.7 Authenticated SQL Injection Vulnerability (CVE-2026-15673)

Vulnerability Overview Vulnerability Name: SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings CVE ID: CVE-2026-15673 CVSS Score: 4.4 (Medium) Release Date: July 27, 2026 Last Updated: July 28, 2026 Researcher: Wordfence PRISM - Wordfence Affected Scope Software Type: Plugin Software Name: SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Affected Versions: <= 3.9.7 Fixed Version: 3.9.8 Remediation Recommendation: Update to version 3.9.8 or a newer patched version. Vulnerability Description This vulnerability allows an authenticated attacker (Administrator level and above) to append additional SQL queries to the WordPress database by exploiting user-supplied parameters in the and settings, thereby extracting sensitive information. This is a secondary SQL injection vulnerability where malicious payloads are stored in the and settings and executed when the WP-Cron event triggers . References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter - CVE ID: CVE-2026-15670 - CVSS Score: 4.9 - Researcher: Wordfence PRISM - Date: July 27, 2026 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter - CVE ID: CVE-2026-15014 - CVSS Score: 9.8 - Researcher: Civitasmass - Date: July 27, 2026 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter - CVE ID: CVE-2026-15671 - CVSS Score: 4.9 - Researcher: Wordfence PRISM - Date: July 27, 2026 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset - CVE ID: CVE-2026-11387 - CVSS Score: 9.8 - Researchers: Chloe Chamberland, Wordfence PRISM - Date: June 30, 2026 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization - CVE ID: CVE-2026-54802 - CVSS Score: 5.3 - Researcher: Jakub Herman - Date: June 16, 2026 SMS Alert Order Notifications <= 3.9.0 - Missing Authorization - CVE ID: CVE-2026-52373 - CVSS Score: 4.3 - Researcher: benzeus - Date: February 18, 2026 SMS Alert Order Notifications <= 3.8.8 - Missing Authorization - CVE ID: CVE-2025-66086 - CVSS Score: 5.3 - Researcher: benzeus - Date: December 5, 2025 SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection - CVE ID: CVE-2025-49915 - CVSS Score: 7.5 - Researcher: ChuongVN - Date: August 15, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify_shortcode - CVE ID: CVE-2025-3878 - CVSS Score: 6.4 - Researcher: wesley (wcraft) - Date: May 9, 2025 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserActionFunction - CVE ID: CVE-2025-3876 - CVSS Score: 8.8 - Researcher: wesley (wcraft) - Date: May 9, 2025 More Information Wordfence Intelligence offers free personal and commercial API access to a comprehensive WordPress vulnerability database and stays up-to-date via free webhook integration. Install Wordfence to receive notifications immediately when your website is affected by vulnerabilities. The Wordfence Intelligence WordPress Vulnerability Database is completely free to query and use. See the documentation for information on how to access and use API data. Contact Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-11pm UTC/GMT (excluding weekends and holidays) Response Time: 365 days, 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Twitter Facebook LinkedIn Instagram Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation and Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Sign up for news and updates from our panel of experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved. Other Have you been hacked? Get Help Create Account Sign In View Pricing Disclaimer This record contains copyrighted material. Defiant hereby grants you a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to reproduce, prepare derivative works, publicly display, publicly perform, distribute, and sublicense this software vulnerability information. Any copies made for this purpose must include the Defiant copyright notice and this license. For more information, see Read more.

Goal Reached Thanks to every supporter — we hit 100%!

SMS Alert <= 3.9.7 Authenticated SQL Injection Vulnerability (CVE-2026-15673)

More from this source