The SMS Alert – SMS & OTP for WooCommerce plugin is vulnerable to a second‑order SQL injection that occurs when an attacker with administrator privileges stores malicious input in the 'checkout_payment_plans' or 'order_status' settings. When the plugin’s scheduled cron event runs, the stored value is concatenated into an SQL statement without proper escaping, allowing the attacker to append and execute arbitrary SQL queries against the database. This flaw can lead to disclosure of sensitive data such as user accounts and order information, and could be leveraged by a determined adversary to modify data or further compromise the site.

The vulnerability exists in all releases of the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin up to and including version 3.9.7. The affected vendor is cozyvision1 and the product is the SMS Alert WordPress plugin for WooCommerce sites.

The CVSS score of 4.4 indicates a moderate impact when authenticated, and the EPSS score of < 1% suggests a low likelihood of widespread exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Because exploitation requires administrator access and the crafted payload is stored before it is executed, the attack vector is inferred to be an authenticated, second‑order injection via the plugin’s settings interface. If the vulnerable plugin is in active use, the risk is elevated for any site with a compromised or weak administrator account.