CVE-2026-15670

Name of the Vulnerable Software and Affected Versions SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery versions prior to 3.9.8

Description This issue involves a time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. The flaw exists due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can exploit the orderby parameter to append malicious SQL queries and extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.9.7. Avoid using the orderby parameter until the update is applied.