This vulnerability in Cozy Vision's SMS Alert Order Notifications plugin (<= 3.8.5) arises from improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates that an unauthenticated attacker can remotely exploit this vulnerability with low complexity, causing a complete confidentiality breach and partial availability loss. No vendor advisory or patch links are available to confirm remediation status.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, leading to full disclosure of sensitive data (confidentiality impact is high). The integrity impact is not indicated, but availability impact is low, suggesting some disruption is possible. This could compromise the security of the affected system and any data it manages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and monitor for unusual activity. Avoid exposing the vulnerable plugin to untrusted networks. Do not rely on generic mitigations; wait for vendor updates.