CVE-2026-15670 Overview
CVE-2026-15670 is a time-based SQL injection vulnerability in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The flaw affects all versions up to and including 3.9.7. It exists in the handling of the orderby parameter, which is not sufficiently escaped and is concatenated into an existing SQL query without proper preparation. Authenticated attackers with administrator-level access or higher can append additional SQL to running queries and extract sensitive data from the WordPress database. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can perform time-based blind SQL injection through the orderby parameter to exfiltrate database contents including WordPress user credentials and customer data.
Affected Products
- SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress
- All versions up to and including 3.9.7
- WordPress sites running the vulnerable sms-alert plugin with WooCommerce
Discovery Timeline
- 2026-07-28 - CVE-2026-15670 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15670
Vulnerability Analysis
The vulnerability resides in the class-backinstock.php helper file of the SMS Alert plugin. According to the WordPress plugin source references, the affected code paths appear at lines 813, 822, and 1105 of the file in version 3.9.7. The plugin constructs SQL queries that incorporate the user-supplied orderby request parameter directly into query strings. The lack of proper escaping and the absence of $wpdb->prepare() with parameter placeholders allows attacker-controlled input to alter query semantics.
Because the injection point is an ORDER BY clause, direct union-based extraction is not straightforward. Attackers instead use time-based blind techniques such as SLEEP() conditionals to infer database contents one bit at a time. Successful exploitation yields read access to arbitrary tables, including wp_users password hashes and WooCommerce customer records.
Root Cause
The root cause is improper input neutralization ([CWE-89]). WordPress provides $wpdb->prepare() and esc_sql() for safe query construction, but the affected code paths interpolate the orderby value directly. ORDER BY clauses cannot be parameterized with placeholders in the same manner as values, so developers must explicitly allow-list column names — a control that is missing here.
Attack Vector
Exploitation requires an authenticated session with administrator-level privileges or higher. The attacker submits a crafted orderby value to a plugin endpoint that reaches the vulnerable back-in-stock query builder. The payload contains conditional time-delay functions that cause the database to pause when a predicate is true, enabling byte-by-byte extraction over repeated requests. No user interaction beyond the attacker's own authenticated session is required. The high privilege requirement narrows the practical threat to compromised admin accounts, malicious insiders, or post-exploitation escalation scenarios.
See the Wordfence Vulnerability Report and the WordPress Code Review for technical detail on the sink locations.
Detection Methods for CVE-2026-15670
Indicators of Compromise
- HTTP requests to WordPress admin endpoints containing orderby parameter values with SQL keywords such as SLEEP, BENCHMARK, IF(, CASE WHEN, or comment sequences (--, /*).
- Anomalously long response times from wp-admin requests correlated with the SMS Alert plugin's back-in-stock functionality.
- MySQL general or slow query log entries showing ORDER BY clauses containing conditional expressions or nested SELECT statements.
- Unexpected outbound queries from the web application user against wp_users, wp_usermeta, or WooCommerce order tables.
Detection Strategies
- Inspect web server access logs for authenticated admin sessions issuing repeated requests to plugin endpoints with varying orderby values.
- Enable MySQL query logging and alert on SLEEP( or BENCHMARK( appearing inside ORDER BY clauses from the WordPress database user.
- Deploy a web application firewall (WAF) rule that inspects the orderby parameter and blocks values outside an allow-list of known column names.
Monitoring Recommendations
- Track and alert on WordPress administrator account logins from new IP addresses or user agents.
- Baseline the response time of SMS Alert plugin endpoints and alert on statistical outliers indicative of time-based injection probing.
- Forward WordPress, PHP-FPM, and MySQL logs to a central analytics platform to correlate admin activity with database anomalies.
How to Mitigate CVE-2026-15670
Immediate Actions Required
- Update the SMS Alert plugin to the version published in the WordPress Change Set 3623914, which supersedes 3.9.7.
- Audit all WordPress administrator accounts, remove unused accounts, and enforce multi-factor authentication on remaining privileged users.
- Review recent admin session activity and MySQL logs for evidence of orderby-based injection payloads.
- Rotate WordPress secret keys in wp-config.php and reset administrator passwords if compromise is suspected.
Patch Information
The vendor addressed the issue in the release following 3.9.7. The corrective change is recorded in the WordPress plugin repository change set 3623914. Site operators should verify the installed version via the WordPress admin plugin page and confirm the vulnerable file helper/class-backinstock.php has been updated. Reference the WordPress Change Set for the exact code diff.
Workarounds
- Temporarily deactivate the SMS Alert plugin until the patched version is installed on production sites.
- Restrict WordPress admin access to specific IP ranges using web server or WAF rules to reduce the exploitable surface.
- Deploy a virtual patch at the WAF layer that enforces an allow-list of valid orderby column values and blocks any input containing SQL functions or comment tokens.
- Apply least-privilege on the MySQL user used by WordPress so it cannot read tables outside those required by the application.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
