CVE-2026-15671: WordPress SMS Alert Plugin SQLi Vulnerability

CVE-2026-15671 Overview

CVE-2026-15671 is a SQL Injection vulnerability [CWE-89] affecting the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The flaw exists in all plugin versions up to and including 3.9.7. The vulnerability stems from insufficient escaping of the user-supplied id parameter and a lack of proper query preparation on existing SQL statements. Authenticated attackers with administrator-level privileges or higher can append additional SQL queries to extract sensitive information from the WordPress database.

Critical Impact
Authenticated administrators can execute arbitrary SQL commands against the underlying database, enabling extraction of stored credentials, session tokens, customer PII, and WooCommerce order data.

Affected Products

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress
All plugin versions up to and including 3.9.7
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2026-07-28 - CVE-2026-15671 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15671

Vulnerability Analysis

The vulnerability is a generic SQL Injection issue [CWE-89] triggered through the id parameter accepted by the plugin. The plugin builds SQL queries by concatenating the attacker-controlled id value without proper escaping or the use of prepared statements via WordPress's $wpdb->prepare() API. As a result, an attacker can break out of the intended query context and append arbitrary SQL fragments, including UNION SELECT statements that read from other tables in the database.

Affected code paths referenced in the plugin source include SMSAlert-wc-order-sms.php (lines 106 and 196), the abandoned-cart helper helper/class-abandonedcart.php (line 1716), and the SMS campaign template at template/sms_campaign.php (line 56). Exploitation requires an authenticated session with administrator-level access, which limits the attack surface but does not eliminate risk in multi-admin environments, shared hosting, or scenarios involving compromised admin credentials.

Root Cause

The root cause is direct interpolation of the id request parameter into SQL statements without sanitization through esc_sql(), absint(), or parameterized binding through $wpdb->prepare(). WordPress plugin developers are expected to use prepared statements for any variable interpolated into a SQL query. In this plugin, existing queries lacked sufficient preparation, allowing metacharacters in the id parameter to alter query structure.

Attack Vector

The vulnerability is exploitable over the network by an authenticated attacker holding administrator privileges. An attacker submits a crafted id parameter to a plugin endpoint that reaches one of the vulnerable query builders. Injected SQL then executes with the privileges of the WordPress database user, exposing data confidentiality but not directly impacting integrity or availability, according to the published CVSS vector. Refer to the Wordfence Vulnerability Analysis and the plugin source at line 106 for the specific sink locations.

Detection Methods for CVE-2026-15671

Indicators of Compromise

Web server or WordPress access logs containing requests to plugin endpoints with SQL metacharacters in the id parameter, such as single quotes, UNION, SELECT, SLEEP(, or comment sequences (--, #, /*).
Unexpected wp_users or wp_options read patterns in database query logs originating from PHP processes handling the SMS Alert plugin.
Administrator sessions issuing requests with abnormally long or encoded id parameter values.

Detection Strategies

Enable MySQL/MariaDB general query logging or the slow query log on WordPress hosts and alert on UNION SELECT patterns originating from plugin PHP files.
Deploy a web application firewall ruleset that inspects the id parameter on requests routed to SMSAlert-wc-order-sms.php, class-abandonedcart.php, and sms_campaign.php.
Correlate authenticated administrator activity with anomalous database read volumes to identify credential extraction attempts.

Monitoring Recommendations

Monitor changes to installed plugin versions and confirm the SMS Alert plugin is upgraded past 3.9.7 once a patched release is available.
Track new administrator account creation and privilege changes in WordPress, since exploitation requires administrator access that may itself have been obtained through prior compromise.
Forward WordPress, PHP-FPM, and web server logs to a centralized logging platform for retention and anomaly detection.

How to Mitigate CVE-2026-15671

Immediate Actions Required

Update the SMS Alert plugin to a version later than 3.9.7 as soon as the vendor publishes a patched release. Review the plugin change log for the fix commit.
Audit the WordPress administrator user list and remove or downgrade unnecessary accounts to reduce the population of users who can trigger the vulnerability.
Rotate WordPress administrator passwords and enforce multi-factor authentication for all administrator accounts.

Patch Information

The vendor commit referenced in the CVE data addresses the SQL injection sinks in SMSAlert-wc-order-sms.php, helper/class-abandonedcart.php, and template/sms_campaign.php. Site operators should install the fixed plugin release from the WordPress.org plugin directory once available and verify the installed version reports higher than 3.9.7.

Workarounds

Deactivate and remove the SMS Alert plugin until a fixed version is installed if the plugin is not business-critical.
Restrict access to /wp-admin/ using IP allow lists at the web server or WAF layer to limit which network sources can present administrator sessions.
Deploy WAF rules that block SQL metacharacters in the id parameter on requests targeting the plugin's PHP files.

bash

# Example Nginx location block restricting wp-admin to trusted IPs
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}