CVE-2026-15670 is a time-based SQL Injection vulnerability in the SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The issue arises from improper neutralization of special elements in the 'orderby' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with administrator privileges can exploit this to append SQL commands and extract sensitive data from the database. The vulnerability affects all plugin versions up to and including 3.9.7. No official patch or remediation level has been provided by the vendor as of the published date.

An attacker with administrator-level access can exploit the SQL Injection vulnerability to extract sensitive information from the database. This compromises the confidentiality of the data but does not affect integrity or availability according to the CVSS vector. The vulnerability requires high privileges and no user interaction, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'orderby' parameter. Avoid using affected plugin versions if possible.