SQL Injection Vulnerability in SMS Alert Plugin for WordPress

CVE-2026-15671

What is CVE-2026-15671?

The SMS Alert – SMS & OTP for WooCommerce plugin for WordPress suffers from a vulnerability that allows attackers to exploit the 'id' parameter due to insufficient input escaping and inadequate query preparation. This flaw enables authenticated individuals with administrative privileges to inject additional SQL commands into existing queries, potentially granting unauthorized access to sensitive database information. It is essential for users of versions up to and including 3.9.7 to apply necessary updates or implement security measures to mitigate this risk.

References