CVE-2026-15671 is a SQL Injection vulnerability (CWE-89) in the cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The issue exists in the 'id' parameter due to insufficient escaping of user input and lack of prepared statements in SQL queries. Authenticated attackers with administrator or higher privileges can inject additional SQL commands to extract sensitive data from the database. This affects all plugin versions up to and including 3.9.7. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not impact availability or integrity but compromises confidentiality. The CVSS score of 4.9 reflects a medium severity impact with network attack vector, low attack complexity, and high privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving the 'id' parameter. Avoid exposing the vulnerable plugin to untrusted users. Follow vendor updates for a forthcoming patch or official mitigation.