The vulnerability identified as CVE-2025-26988 affects Cozy Vision's SMS Alert Order Notifications plugin (versions up to 3.7.8). It is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating remote, unauthenticated exploitation with high confidentiality impact and low availability impact. No patch or official vendor advisory is currently provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. No known exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and monitoring for unusual database activity. Avoid exposing the affected plugin to untrusted networks where possible.