CVE-2025-47682 is a critical SQL injection flaw (CVSS 9.3) in the SMS Alert Order Notifications plugin for WordPress and WooCommerce, versions through 3.8.1. It needs no login. Patchstack lists 3.8.2 as the patched version, so update to 3.8.2 or later now.
What's affected
The record says SMS Alert Order Notifications from Cozy Vision is affected through 3.8.1. Patchstack lists 3.8.2 as the patched version.
The vector shows network access, low complexity, no privileges and no user interaction. Scope is changed, confidentiality impact is high and availability impact is low. In short, an unauthenticated visitor could read data from the database.
The record does not mark CVE-2025-47682 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=sms-alert --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
This plugin is used with WooCommerce stores, which means the database holds customer names, phone numbers and order history. Check your store first, then any other sites that share the same database server.
What to do now
- Update SMS Alert Order Notifications to 3.8.2 or later. With WP-CLI that is
wp plugin update sms-alert. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- If the plugin was active and public before you updated, review the database for unexpected admin users, and consider rotating passwords and API keys stored in the database.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record classifies this as CWE-89, SQL injection. Input reaches a database query without being kept separate from the command. Patchstack's summary of this class is that attackers can read, modify or delete the database, including user accounts and private data.
For a store plugin that handles order notifications, that data is customer contact details and order records. The fix in code is parameterized queries. The fix for you is the update.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What version fixes CVE-2025-47682?
Patchstack lists SMS Alert Order Notifications 3.8.2 as patched. Update to 3.8.2 or later.
Is a login needed to reach it?
No. The vector in the record lists no privileges required and no user interaction.
Sources
Last reviewed: 18 October 2026.
