CVE-2025-26988: Cozyvision SMS Alert SQLi Vulnerability

CVE-2025-26988 Overview

CVE-2025-26988 is a SQL Injection vulnerability in the Cozy Vision SMS Alert Order Notifications plugin for WordPress, also known as sms-alert. The flaw affects all versions up to and including 3.7.8. The plugin fails to properly neutralize special elements used in SQL commands, allowing remote attackers to inject arbitrary SQL through unsanitized input. Attackers can exploit this issue over the network without authentication or user interaction. The vulnerability is tracked under CWE-89 and was disclosed through Patchstack.

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents from affected WooCommerce sites, including customer records, order data, and credentials stored in the WordPress database.

Affected Products

• Cozy Vision SMS Alert Order Notifications WordPress plugin (sms-alert)
• All versions from n/a through 3.7.8
• WordPress sites using the plugin with WooCommerce integration

Discovery Timeline

• 2025-03-03 - CVE-2025-26988 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26988

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters in SQL statements processed by the SMS Alert Order Notifications plugin. The plugin accepts attacker-controlled input and concatenates it into SQL queries without using prepared statements or proper escaping through wpdb::prepare(). This allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

The CVSS vector indicates a confidentiality-only impact, meaning successful exploitation primarily exposes database contents rather than modifying records or disrupting service. EPSS data places exploitation probability at 0.106% with a percentile of 28.149, indicating limited current exploitation activity. However, WordPress plugin SQL injection flaws are routinely automated by botnets once details become public.

Root Cause

The root cause is a failure to sanitize or parameterize user-supplied input before incorporating it into SQL queries. The plugin uses string concatenation when building queries against the WordPress database, violating the safe data access patterns recommended by the WordPress Plugin Handbook. The wpdb abstraction provides prepare() for placeholder binding, but the vulnerable code paths bypass this mechanism.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to an endpoint exposed by the plugin. The malicious payload contains SQL metacharacters such as single quotes, UNION SELECT clauses, or boolean conditions. Because no privileges or user interaction are required, attackers can automate scans across WordPress sites and exfiltrate data using time-based or union-based injection techniques. Refer to the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2025-26988

Indicators of Compromise

• HTTP requests to plugin endpoints under /wp-content/plugins/sms-alert/ containing SQL metacharacters such as ', --, UNION, or SLEEP(
• Anomalous response times indicating time-based blind SQL injection probing
• Unexpected database errors in PHP logs referencing wpdb or MySQL syntax errors
• Outbound traffic patterns consistent with data exfiltration following plugin endpoint access

Detection Strategies

• Inspect web server access logs for query strings containing URL-encoded SQL keywords targeting the sms-alert plugin path
• Deploy a Web Application Firewall (WAF) rule set that flags SQL injection signatures on WordPress plugin endpoints
• Monitor the WordPress database for unusual SELECT activity originating from plugin-related PHP execution
• Correlate failed query errors with subsequent successful requests from the same source IP

Monitoring Recommendations

• Enable WordPress debug logging and forward logs to a centralized SIEM for query analysis
• Track plugin version inventory across managed WordPress fleets to identify hosts running sms-alert<= 3.7.8
• Alert on outbound HTTP responses with unusually large body sizes from WordPress hosts, which may indicate database content exfiltration

How to Mitigate CVE-2025-26988

Immediate Actions Required

• Update the SMS Alert Order Notifications plugin to a version newer than 3.7.8 once a patched release is available from Cozy Vision
• Deactivate and remove the plugin if no patched version is available and the functionality is not business-critical
• Audit WordPress and WooCommerce databases for evidence of unauthorized SELECT activity or data access
• Rotate any credentials, API keys, or secrets stored in the affected WordPress database

Patch Information

Consult the Patchstack SQL Injection Advisory for the latest patch status. As of publication, the advisory confirms the vulnerability affects all versions through 3.7.8. Administrators should monitor the official plugin repository for an updated release that addresses CWE-89.

Workarounds

• Place a WAF in front of the WordPress site with SQL injection protection enabled and tuned for plugin endpoint paths
• Restrict access to the affected plugin endpoints by IP allowlist where operationally feasible
• Apply virtual patching rules through Patchstack or equivalent WordPress security platforms until a vendor fix ships
• Limit WordPress database user privileges to the minimum required by WooCommerce to reduce the blast radius of successful injection