The Cozy Vision SMS Alert Order Notifications plugin contains an SQL injection flaw that allows an attacker to append malicious SQL code to user‑controlled input. When exploited, the database engine will execute the injected statements, resulting in the attacker gaining read, write or delete access to order and customer data. The vulnerability could expose payment details, compromise customer confidentiality, or allow an attacker to alter transactional records for financial gain.

WordPress sites that have the Cozy Vision SMS Alert Order Notifications plugin installed, from its first release up through version 3.8.1. All these releases are free, and the flaw exists regardless of the active theme or other installed plugins. If the plugin is active, the affected endpoints are reachable through normal web requests to the plugin’s administrative URLs.

The CVSS base score of 9.3 denotes a critical level of severity. However, the EPSS score is below 1 %, indicating that current exploitation levels are low. The vulnerability is not listed in the CISA KEV catalog, so there is no known public exploitation at this time. The attack vector is inferred to be remote, accessed via a web request to the plugin’s backend, and the exploit appears to require no authenticated user context. Given the high severity score and the straightforward nature of the injection when the plugin is exposed, a high-priority remediation effort is warranted.