CVE Intelligence
Analysis AI-assisted

CVE-2025-49915: Cozy Vision SMS Alert Order Notifications (sms-alert) SQL Injection in WordPress Plugin

CVE-2025-49915 is an SQL injection flaw (CWE-89) in the SMS Alert Order Notifications WordPress plugin (sms-alert), recorded as affecting versions from n/a through 3.8.5. The CNA-provided CVSS 3.1 score is 9.3 (critical), with a network attack vector and no privileges or user interaction required. The record shows no CISA KEV listing and no fixed version, so administrators should verify their installed version and check the vendor advisory.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes an SQL injection flaw (CWE-89) in the SMS Alert Order Notifications WordPress plugin (sms-alert), as documented in the Patchstack database entry. The issue is recorded as affecting versions from n/a through 3.8.5.

Impact

The CVSS 3.1 vector supplied by the CNA indicates a network attack vector, low attack complexity, no privileges and no user interaction required, and a changed scope. Confidentiality impact is rated high, integrity impact none and availability impact low.

  • A successful SQL injection could expose data held in the site database.
  • The exact data reachable and the extent of any write or availability effects are not described in the record.

Affected products and versions

  • Product: SMS Alert Order Notifications (sms-alert), a WordPress plugin.
  • Range as recorded: n/a through 3.8.5 (inclusive).
  • The record contains no structured affected or fixed version entries.

Exploitation status

The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this record.

Remediation and mitigation

  • Identify every WordPress site running the plugin and confirm the installed version.
  • Check the Patchstack entry and the plugin vendor for a fixed release, since the record does not provide one.
  • If a fixed version is not yet verified and the plugin is not essential, consider deactivating it.
  • Limit database account privileges to what the site needs and keep WordPress core and other plugins up to date.

Detection guidance

  • Review web server and application logs for unusual parameter values or repeated errors on endpoints used by the plugin.
  • Monitor database logs for unexpected query errors or atypical data access from the web application account.
  • Where a web application firewall is used, review logged alerts for suspicious input patterns and tune rules to limit false positives.

Limitations of the available information

  • The record does not identify a fixed version, vendor patch details or the specific vulnerable parameter.
  • The lower bound of the affected range is given only as n/a.
  • EPSS values are model estimates and do not confirm exploitation.
  • The record status is Deferred, so details may change as sources are updated.

Frequently asked questions

What is CVE-2025-49915?

It is an SQL injection vulnerability (CWE-89) in the SMS Alert Order Notifications WordPress plugin (sms-alert), recorded as affecting versions from n/a through 3.8.5.

How severe is this issue according to the record?

The CNA Patchstack provides a CVSS 3.1 base score of 9.3, rated critical, with a network attack vector and no privileges or user interaction required.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this record.

What should administrators do now?

Confirm whether the plugin is installed and its version, check the vendor or Patchstack entry for a fix, consider deactivating the plugin if it is not essential, and limit database privileges until a fix is verified.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.