CVE-2026-15673 Overview
CVE-2026-15673 is a second-order SQL injection vulnerability in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The flaw affects all versions up to and including 3.9.7. The vulnerability resides in the checkout_payment_plans and order_status settings, which are stored via update_option() and later concatenated into SQL queries without sufficient escaping or parameterization. Authenticated attackers with administrator-level access can inject additional SQL statements that execute when the cod_to_prepaid_cart_notification_sendsms_hook WP-Cron event triggers SA_CodTOPrepaid::sendSms(). Successful exploitation allows extraction of sensitive database information.
Critical Impact
Administrator-level attackers can store malicious SQL payloads in plugin settings that execute asynchronously via WP-Cron, leading to unauthorized disclosure of database contents.
Affected Products
- SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress
- All versions up to and including 3.9.7
- WordPress sites running WooCommerce with the SMS Alert plugin installed
Discovery Timeline
- 2026-07-28 - CVE-2026-15673 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15673
Vulnerability Analysis
The vulnerability is a stored, second-order SQL injection classified under [CWE-89]. Administrator-level users can save arbitrary values into the checkout_payment_plans and order_status plugin settings. These settings are persisted using WordPress's update_option() function without sanitization of SQL metacharacters.
When the cod_to_prepaid_cart_notification_sendsms_hook WP-Cron event fires, the SA_CodTOPrepaid::sendSms() method retrieves the stored settings and interpolates them directly into a database query. Because the plugin does not use wpdb::prepare() with proper placeholders on the affected query paths, injected SQL fragments are appended to the intended statement and executed against the database.
Root Cause
The root cause is insufficient escaping on user-supplied parameters combined with the absence of prepared statements around the existing SQL query. The affected code paths are visible in SMSAlert-wc-order-sms.php (lines 116 and 177), classes/setting-options.php (lines 408 and 505), and handler/forms/woocommerce/wc-checkout.php (lines 2523, 2525, and 2543). Trust is placed in the stored option value rather than the query construction, which is the classic second-order pattern.
Attack Vector
An authenticated attacker with administrator privileges submits a crafted payload to the plugin's settings interface. The payload is stored in the WordPress options table. Execution is deferred until the scheduled WP-Cron event runs SA_CodTOPrepaid::sendSms(), at which point the injected SQL executes with the privileges of the database user. Because impact is limited to confidentiality of database contents, the CVSS scope is unchanged and integrity and availability are not affected.
No verified public exploit code is available. See the Wordfence Vulnerability Intelligence entry and the WordPress Plugin Source Code references for the vulnerable code paths.
Detection Methods for CVE-2026-15673
Indicators of Compromise
- Unexpected SQL syntax (UNION, SELECT, --, /*) stored in the checkout_payment_plans or order_status rows of the WordPress wp_options table.
- Anomalous database queries originating from the SA_CodTOPrepaid::sendSms() execution path during WP-Cron runs.
- Administrator account edits to SMS Alert plugin settings from unusual source IP addresses or user agents.
- Presence of the SMS Alert plugin at version 3.9.7 or earlier without corresponding patch application.
Detection Strategies
- Audit the wp_options table for entries named checkout_payment_plans and order_status and inspect their values for SQL metacharacters.
- Enable WordPress database query logging and correlate query anomalies with WP-Cron execution windows for the cod_to_prepaid_cart_notification_sendsms_hook event.
- Review web server access logs for administrator POST requests to the SMS Alert settings endpoints followed by delayed database anomalies.
- Monitor for creation, modification, or privilege escalation of administrator accounts prior to plugin setting changes.
Monitoring Recommendations
- Alert on any modification to SMS Alert plugin options through file integrity or database change monitoring.
- Track WP-Cron event execution latency and error rates for cod_to_prepaid_cart_notification_sendsms_hook.
- Baseline outbound queries from the WordPress database user and flag statements referencing sensitive tables such as wp_users or wp_usermeta.
- Retain WordPress audit logs for administrator sessions for a minimum of 90 days to support forensic review.
How to Mitigate CVE-2026-15673
Immediate Actions Required
- Update the SMS Alert plugin to the version released after 3.9.7 that addresses the flaw. Review the WordPress Plugin Change Log for the fixed revision.
- Inspect and sanitize the checkout_payment_plans and order_status option values in the database before restoring normal operations.
- Rotate WordPress administrator credentials and enforce multi-factor authentication on all administrative accounts.
- Review WP-Cron scheduled events and disable the vulnerable hook until the patch is applied if the plugin cannot be updated immediately.
Patch Information
The plugin developer committed a fix referenced in the WordPress Plugin Change Log. Site administrators should upgrade to the first release above 3.9.7 that includes this changeset. Verify plugin integrity after upgrade and confirm that stored settings do not contain residual injection payloads.
Workarounds
- Deactivate and remove the SMS Alert plugin until an upgrade is applied if the plugin's functionality is not business-critical.
- Restrict administrator access by IP allowlisting the /wp-admin/ interface at the web server or WAF layer to reduce the pool of accounts that can plant the payload.
- Deploy a Web Application Firewall rule to block SQL metacharacters submitted to the SMS Alert settings endpoints in handler/forms/woocommerce/wc-checkout.php.
- Manually replace the values of checkout_payment_plans and order_status in wp_options with known-good defaults using wp-cli or a database client.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
