CVE-2026-15673 describes a second-order SQL injection vulnerability in the cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress. The issue arises from insufficient escaping of user-supplied parameters in the 'checkout_payment_plans' and 'order_status' settings, which are stored via update_option() and later executed during the cod_to_prepaid_cart_notification_sendsms_hook WP-Cron event in the SA_CodTOPrepaid::sendSms() function. This allows authenticated attackers with administrator privileges to append additional SQL queries to existing queries, enabling extraction of sensitive information from the database. The vulnerability affects all versions up to and including 3.9.7. No official patch or remediation guidance is currently provided.

An attacker with administrator-level access can exploit this vulnerability to execute arbitrary SQL queries by injecting malicious payloads into plugin settings that are later executed by a scheduled task. This can lead to unauthorized disclosure of sensitive database information. The vulnerability does not impact availability or integrity according to the CVSS vector, but confidentiality is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious changes to the 'checkout_payment_plans' and 'order_status' settings. Consider disabling or limiting the affected plugin functionality if feasible.