The SMS Alert plugin for WordPress allows injected SQL code through the 'id' parameter in several internal PHP files. The vulnerability is a classic SQL injection (CWE‑89) that can be leveraged by attackers possessing administrator‑level access or higher. By inserting malicious payloads, an attacker can append additional SQL queries to the existing database calls, potentially exfiltrating sensitive data such as user accounts, orders, and payment information. The description states that the flaw exists in all versions up to and including 3.9.7 and is caused by insufficient escaping and lack of query preparation.

Cozyvision1’s SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin is affected. All releases up to version 3.9.7 contain the flaw; later releases are not documented as vulnerable. WordPress sites that have installed these legacy versions are at risk unless they have already applied an update beyond 3.9.7.

The CVSS base score of 4.9 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated session with administrator or higher privileges. An attacker could log in with such credentials or compromise an existing admin account before exploiting the injection. Due to the lack of public exploit evidence, the immediate risk is considered moderate, but remediation is still advised.