CVE-2025-26988: Cozyvision SMS Alert SQLi Vulnerability

CVE-2025-26988 Overview

CVE-2025-26988 is a SQL injection vulnerability in the Cozy Vision SMS Alert Order Notifications plugin for WordPress. The flaw affects all versions of the sms-alert plugin up to and including 3.7.8. The vulnerability stems from improper neutralization of special elements used in SQL commands [CWE-89]. Attackers can exploit this issue over the network without authentication or user interaction to inject arbitrary SQL into backend database queries.

Critical Impact
Unauthenticated remote attackers can extract sensitive data from WordPress databases hosting the vulnerable plugin, including user credentials, order details, and customer information.

Affected Products

Cozy Vision SMS Alert Order Notifications WordPress plugin (sms-alert)
All versions from initial release through 3.7.8
WordPress sites running WooCommerce integrations with this plugin enabled

Discovery Timeline

2025-03-03 - CVE-2025-26988 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26988

Vulnerability Analysis

The vulnerability resides in the SMS Alert Order Notifications plugin, which integrates WooCommerce order events with SMS notification services. The plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. This allows attackers to manipulate query structure and execute arbitrary SQL statements against the WordPress database.

The issue impacts confidentiality directly. Database contents — including wp_users, order metadata, and authentication tokens — become accessible to attackers who craft malicious requests. The CWE-89 classification confirms the root cause as improper neutralization of SQL syntax elements in user input.

With an EPSS score of 0.106% (28th percentile), active exploitation probability is currently low. However, SQL injection flaws in WordPress plugins frequently attract opportunistic attackers using automated scanners targeting WooCommerce ecosystems.

Root Cause

The plugin constructs SQL queries by concatenating user-controlled parameters directly into query strings. Developers did not implement prepared statements via $wpdb->prepare() or apply input validation to parameters reaching database functions. This pattern enables attackers to break out of intended query context and append arbitrary SQL clauses.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. No authentication or user interaction is required. An attacker sends crafted HTTP requests to vulnerable plugin endpoints, embedding SQL syntax in parameters that the plugin passes unsanitized to the database layer. Typical exploitation uses UNION SELECT payloads or boolean-based blind injection techniques to extract data row by row. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-26988

Indicators of Compromise

HTTP requests to plugin endpoints containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP(
Unexpected database errors logged by WordPress or MySQL referencing plugin-related queries
Anomalous outbound traffic from the web server following requests to sms-alert plugin paths
New or modified administrator accounts in wp_users without corresponding administrative activity

Detection Strategies

Inspect web server access logs for suspicious query parameters targeting /wp-content/plugins/sms-alert/ or related AJAX endpoints
Enable WordPress debug logging and review MySQL slow query and error logs for malformed statements
Deploy a web application firewall with SQL injection signatures tuned for WordPress plugin payloads

Monitoring Recommendations

Monitor for spikes in 500-series HTTP responses originating from plugin endpoints
Alert on database queries returning unusually large result sets from plugin-invoked code paths
Track changes to sensitive tables including wp_users, wp_usermeta, and wp_options

How to Mitigate CVE-2025-26988

Immediate Actions Required

Identify all WordPress installations running the SMS Alert Order Notifications plugin at version 3.7.8 or earlier
Disable or remove the plugin until a vendor patch is verified installed
Rotate WordPress administrator credentials and WooCommerce API keys if exploitation is suspected
Review database audit logs for unauthorized read activity against customer and user tables

Patch Information

At the time of CVE publication, the affected version range covers all releases through 3.7.8. Administrators should consult the Patchstack advisory and the WordPress plugin repository for updated releases that address the flaw. Apply the fixed version as soon as it is published by the vendor.

Workarounds

Remove the sms-alert plugin directory from wp-content/plugins/ until a patched release is available
Restrict access to plugin endpoints using web server rules or .htaccess IP allowlisting
Deploy a WAF rule blocking SQL syntax patterns in requests targeting the plugin path

bash

# Example: temporarily disable the plugin via WP-CLI
wp plugin deactivate sms-alert
wp plugin delete sms-alert