The flaw permits an attacker to inject arbitrary SQL statements through Cozy Vision’s SMS Alert Order Notifications plugin, exploiting insufficient input validation. This vulnerability (CWE‑89) can expose, modify, or delete confidential order data, potentially compromising the integrity and confidentiality of the e‑commerce platform and allowing an attacker to gain full control of the underlying database.

The insecure plugin version is distributed from the initial release through 3.7.8 for WordPress WooCommerce sites. Any installation of SMS Alert Order Notifications that has not been upgraded beyond 3.7.8 is vulnerable.

With a CVSS score of 9.3 the flaw is considered critical, yet the EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating limited current exploitation. The likely attack vector involves remote HTTP interactions with the plugin’s WooCommerce order‑notification endpoints, potentially without authentication; however, the exact prerequisite conditions are not detailed in the advisory.